https://seclists.org/oss-sec/2026/q3/508: Fwd: OpenZFS Linux open zpool manipulation and escapes via unprivileged userns

Q: Which OpenZFS code revision was audited?

The audit covered OpenZFS development revision 9b7642df931a765509403318553f2910daf71305, identified as version 2.4.99-1. Its commit title is “Harden recv record validation.”

Q: What environments were used to validate the findings?

Validation included a disposable QEMU guest using generic KASAN with CONFIG_KASAN_VMALLOC=y, and a stock IncusOS appliance guest for deployment-level authorization and volume-swap validation. The validation kernel was 7.2.0-rc3-00275-gaf5e34a41cd6.

Q: Are upstream fixes or mitigation guidance available in the provided report?

The report states that the author hoped upstream patches and remediation guidance would be available soon. It does not provide specific patches, workarounds, or configuration mitigations.

Published Aug 16, 2026

Updated

Affected Software

1 affected component

OpenZFS OpenZFS on Linux (spl.ko and zfs.ko)>2.4.99-1<=2.4.99-1

Frequently Asked Questions

Which OpenZFS code revision was audited?

The audit covered OpenZFS development revision 9b7642df931a765509403318553f2910daf71305, identified as version 2.4.99-1. Its commit title is “Harden recv record validation.”

What environments were used to validate the findings?

Validation included a disposable QEMU guest using generic KASAN with CONFIG_KASAN_VMALLOC=y, and a stock IncusOS appliance guest for deployment-level authorization and volume-swap validation. The validation kernel was 7.2.0-rc3-00275-gaf5e34a41cd6.

Are upstream fixes or mitigation guidance available in the provided report?

The report states that the author hoped upstream patches and remediation guidance would be available soon. It does not provide specific patches, workarounds, or configuration mitigations.