{"id":"CVE-2026-79619","aliases":["DEBIAN-CVE-2026-79619","EUVD-2026-66419","GHSA-5v2p-vxxv-r62r","GHSA-mhf5-q8gw-qg9v","UBUNTU-CVE-2026-79619","USN-8705-1","USN-8705-2"],"status":"published","title":"OpenZFS: user-namespace capability check allows unprivileged local authorization bypass","description":"On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.","severity":{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00198,"percentile":0.0956,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-08-26T12:50:10Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Debian:13","package":"zfs-linux","fixed_in":["2.3.9-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zfs-linux","fixed_in":["2.4.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zfs-linux","fixed_in":["0.7.5-1ubuntu16.12+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zfs-linux","fixed_in":["0.8.3-1ubuntu12.18+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"zfs-linux","fixed_in":["2.1.5-1ubuntu6~22.04.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"zfs-linux","fixed_in":["2.2.2-0ubuntu9.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"zfs-linux","fixed_in":["2.4.1-1ubuntu5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.5.10-1","0.6.5.11-1","0.6.5.11-1~bpo8+1","0.6.5.11-1~bpo9+1","0.6.5.5-1","0.6.5.6-1","0.6.5.6-2","0.6.5.7-1","0.6.5.7-2","0.6.5.7-2~bpo8+1","0.6.5.8-1","0.6.5.8-1~bpo8+1","0.6.5.8-2","0.6.5.8-2~bpo8+1","0.6.5.8-3","0.6.5.9-1","0.6.5.9-2","0.6.5.9-2~bpo8+1","0.6.5.9-3","0.6.5.9-4","0.6.5.9-5","0.6.5.9-5+sparc64","0.6.5.9-5~bpo8+1","0.7.11-1","0.7.11-1~bpo8+1","0.7.11-1~bpo9+1","0.7.11-2","0.7.11-3","0.7.12-1","0.7.12-1~bpo9+1","0.7.12-2","0.7.12-3","0.7.12-4","0.7.12-5","0.7.13-1","0.7.13-1~bpo10+1","0.7.13-1~bpo9+1","0.7.3-1","0.7.3-2","0.7.3-3","0.7.3-3~bpo8+1","0.7.3-3~bpo9+1","0.7.4-1","0.7.4-1~bpo8+1","0.7.4-1~bpo9+1","0.7.5-1","0.7.5-1~bpo9+1","0.7.6-1","0.7.6-1~bpo8+1","0.7.6-1~bpo9+1","0.7.9-0.1","0.7.9-1","0.7.9-2","0.7.9-3","0.7.9-3~bpo8+1","0.7.9-3~bpo9+1","0.8.0-1","0.8.0-2","0.8.0~rc3-1","0.8.0~rc4-1","0.8.1-1","0.8.1-2","0.8.1-3","0.8.1-4","0.8.1-4~bpo10+1","0.8.2-1","0.8.2-2","0.8.2-2~bpo10+1","0.8.2-3","0.8.2-3~bpo10+1","0.8.2-4","0.8.2-5","0.8.3-1","0.8.3-1~bpo10+1","0.8.3-2","0.8.4-1","0.8.4-1~bpo10+1","0.8.4-2","0.8.4-2~bpo10+1","0.8.5-1","0.8.5-2","0.8.5-2~bpo10+1","0.8.5-3","0.8.5-3~bpo10+1","0.8.6-1","0.8.6-1~bpo10+1","2.0.0-1~exp1","2.0.1-1","2.0.1-1~exp1","2.0.1-2","2.0.1-3","2.0.2-1","2.0.2-1~bpo10+1","2.0.3-1","2.0.3-1~bpo10+1","2.0.3-2","2.0.3-3","2.0.3-4","2.0.3-5","2.0.3-6","2.0.3-7","2.0.3-8","2.0.3-8~bpo10+1","2.0.3-9","2.0.3-9~bpo10+1","2.0.6-1","2.0.6-1~bpo10+1","2.0.6-1~bpo11+1","2.0.6-2","2.0.7-1~bpo10+1","2.1.1-1","2.1.1-2","2.1.1-3","2.1.11-1","2.1.11-1+deb12u1","2.1.11-1~bpo11+1","2.1.12-1","2.1.12-2","2.1.12-2~bpo12+1","2.1.13-1","2.1.13-1~bpo11+1","2.1.13-1~bpo12+1","2.1.13-2","2.1.13-2~bpo11+1","2.1.13-2~bpo12+1","2.1.14-1","2.1.14-1~bpo11+1","2.1.14-1~bpo12+1","2.1.2-1","2.1.2-1~bpo11+1","2.1.4-1","2.1.4-1~bpo11+1","2.1.5-1","2.1.5-1~bpo11+1","2.1.6-1","2.1.6-2","2.1.6-3","2.1.6-3~bpo11+1","2.1.7-1","2.1.7-1~bpo11+1","2.1.7-2","2.1.8-1","2.1.9-1","2.1.9-1~bpo11+1","2.1.9-2","2.1.9-3","2.1.9-3~bpo11+1","2.1.9-4","2.2.0-1~exp1","2.2.1-1~exp1","2.2.1-1~exp2","2.2.2-1","2.2.2-1~exp1","2.2.2-2","2.2.2-3","2.2.2-3~bpo12+1","2.2.2-4","2.2.2-4~bpo12+1","2.2.2-5~exp1","2.2.2-5~exp2","2.2.2-5~exp3","2.2.3-1","2.2.3-1~bpo12+1","2.2.3-2","2.2.3-2~bpo12+1","2.2.4-1","2.2.4-1~bpo12+1","2.2.4-2","2.2.5-1","2.2.5-1~bpo12+1","2.2.6-1","2.2.6-1~bpo12+1","2.2.6-1~bpo12+2","2.2.6-1~bpo12+3","2.2.6-2","2.2.7-1","2.2.7-1~bpo12+1","2.2.7-2","2.3.0-1","2.3.0-1~exp1","2.3.0-2","2.3.0-2~exp1","2.3.0~rc5-1~exp1","2.3.0~rc5-1~exp1.1","2.3.1-1","2.3.1-1~bpo12+1","2.3.2-1","2.3.2-2","2.3.2-2~bpo12+1","2.3.2-2~bpo12+2","2.3.3-1","2.3.3-1~bpo13+1","2.3.4-1","2.3.4-1~bpo13+1","2.3.4~git20250812.3b64a96-1","2.3.5-1","2.3.5-2","2.3.5-2~bpo13+1","2.4.0-1","2.4.0-1~bpo13+1","2.4.0-1~exp1","2.4.1-1","2.4.1-1~bpo13+1","2.4.2-1","2.4.2-1~bpo13+1","2.4.2-2","2.4.3-1","2.4.3-1~bpo13+1","2.4.3-2","2.4.3-2~bpo13+1","2.4.3-3","2.4.4-1","2.4.4-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9-0+deb13u1"}]}],"versions":["0.6.5.10-1","0.6.5.11-1","0.6.5.11-1~bpo8+1","0.6.5.11-1~bpo9+1","0.6.5.5-1","0.6.5.6-1","0.6.5.6-2","0.6.5.7-1","0.6.5.7-2","0.6.5.7-2~bpo8+1","0.6.5.8-1","0.6.5.8-1~bpo8+1","0.6.5.8-2","0.6.5.8-2~bpo8+1","0.6.5.8-3","0.6.5.9-1","0.6.5.9-2","0.6.5.9-2~bpo8+1","0.6.5.9-3","0.6.5.9-4","0.6.5.9-5","0.6.5.9-5+sparc64","0.6.5.9-5~bpo8+1","0.7.11-1","0.7.11-1~bpo8+1","0.7.11-1~bpo9+1","0.7.11-2","0.7.11-3","0.7.12-1","0.7.12-1~bpo9+1","0.7.12-2","0.7.12-3","0.7.12-4","0.7.12-5","0.7.13-1","0.7.13-1~bpo10+1","0.7.13-1~bpo9+1","0.7.3-1","0.7.3-2","0.7.3-3","0.7.3-3~bpo8+1","0.7.3-3~bpo9+1","0.7.4-1","0.7.4-1~bpo8+1","0.7.4-1~bpo9+1","0.7.5-1","0.7.5-1~bpo9+1","0.7.6-1","0.7.6-1~bpo8+1","0.7.6-1~bpo9+1","0.7.9-0.1","0.7.9-1","0.7.9-2","0.7.9-3","0.7.9-3~bpo8+1","0.7.9-3~bpo9+1","0.8.0-1","0.8.0-2","0.8.0~rc3-1","0.8.0~rc4-1","0.8.1-1","0.8.1-2","0.8.1-3","0.8.1-4","0.8.1-4~bpo10+1","0.8.2-1","0.8.2-2","0.8.2-2~bpo10+1","0.8.2-3","0.8.2-3~bpo10+1","0.8.2-4","0.8.2-5","0.8.3-1","0.8.3-1~bpo10+1","0.8.3-2","0.8.4-1","0.8.4-1~bpo10+1","0.8.4-2","0.8.4-2~bpo10+1","0.8.5-1","0.8.5-2","0.8.5-2~bpo10+1","0.8.5-3","0.8.5-3~bpo10+1","0.8.6-1","0.8.6-1~bpo10+1","2.0.0-1~exp1","2.0.1-1","2.0.1-1~exp1","2.0.1-2","2.0.1-3","2.0.2-1","2.0.2-1~bpo10+1","2.0.3-1","2.0.3-1~bpo10+1","2.0.3-2","2.0.3-3","2.0.3-4","2.0.3-5","2.0.3-6","2.0.3-7","2.0.3-8","2.0.3-8~bpo10+1","2.0.3-9","2.0.3-9~bpo10+1","2.0.6-1","2.0.6-1~bpo10+1","2.0.6-1~bpo11+1","2.0.6-2","2.0.7-1~bpo10+1","2.1.1-1","2.1.1-2","2.1.1-3","2.1.11-1","2.1.11-1~bpo11+1","2.1.12-1","2.1.12-2","2.1.12-2~bpo12+1","2.1.13-1","2.1.13-1~bpo11+1","2.1.13-1~bpo12+1","2.1.13-2","2.1.13-2~bpo11+1","2.1.13-2~bpo12+1","2.1.14-1","2.1.14-1~bpo11+1","2.1.14-1~bpo12+1","2.1.2-1","2.1.2-1~bpo11+1","2.1.4-1","2.1.4-1~bpo11+1","2.1.5-1","2.1.5-1~bpo11+1","2.1.6-1","2.1.6-2","2.1.6-3","2.1.6-3~bpo11+1","2.1.7-1","2.1.7-1~bpo11+1","2.1.7-2","2.1.8-1","2.1.9-1","2.1.9-1~bpo11+1","2.1.9-2","2.1.9-3","2.1.9-3~bpo11+1","2.1.9-4","2.2.0-1~exp1","2.2.1-1~exp1","2.2.1-1~exp2","2.2.2-1","2.2.2-1~exp1","2.2.2-2","2.2.2-3","2.2.2-3~bpo12+1","2.2.2-4","2.2.2-4~bpo12+1","2.2.2-5~exp1","2.2.2-5~exp2","2.2.2-5~exp3","2.2.3-1","2.2.3-1~bpo12+1","2.2.3-2","2.2.3-2~bpo12+1","2.2.4-1","2.2.4-1~bpo12+1","2.2.4-2","2.2.5-1","2.2.5-1~bpo12+1","2.2.6-1","2.2.6-1~bpo12+1","2.2.6-1~bpo12+2","2.2.6-1~bpo12+3","2.2.6-2","2.2.7-1","2.2.7-1~bpo12+1","2.2.7-2","2.3.0-1","2.3.0-1~exp1","2.3.0-2","2.3.0-2~exp1","2.3.0~rc5-1~exp1","2.3.0~rc5-1~exp1.1","2.3.1-1","2.3.1-1~bpo12+1","2.3.2-1","2.3.2-2","2.3.2-2~bpo12+1","2.3.2-2~bpo12+2","2.3.3-1","2.3.3-1~bpo13+1","2.3.4-1","2.3.4-1~bpo13+1","2.3.4~git20250812.3b64a96-1","2.3.5-1","2.3.5-2","2.3.5-2~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1"}]}],"versions":["0.6.5.10-1","0.6.5.11-1","0.6.5.11-1~bpo8+1","0.6.5.11-1~bpo9+1","0.6.5.5-1","0.6.5.6-1","0.6.5.6-2","0.6.5.7-1","0.6.5.7-2","0.6.5.7-2~bpo8+1","0.6.5.8-1","0.6.5.8-1~bpo8+1","0.6.5.8-2","0.6.5.8-2~bpo8+1","0.6.5.8-3","0.6.5.9-1","0.6.5.9-2","0.6.5.9-2~bpo8+1","0.6.5.9-3","0.6.5.9-4","0.6.5.9-5","0.6.5.9-5+sparc64","0.6.5.9-5~bpo8+1","0.7.11-1","0.7.11-1~bpo8+1","0.7.11-1~bpo9+1","0.7.11-2","0.7.11-3","0.7.12-1","0.7.12-1~bpo9+1","0.7.12-2","0.7.12-3","0.7.12-4","0.7.12-5","0.7.13-1","0.7.13-1~bpo10+1","0.7.13-1~bpo9+1","0.7.3-1","0.7.3-2","0.7.3-3","0.7.3-3~bpo8+1","0.7.3-3~bpo9+1","0.7.4-1","0.7.4-1~bpo8+1","0.7.4-1~bpo9+1","0.7.5-1","0.7.5-1~bpo9+1","0.7.6-1","0.7.6-1~bpo8+1","0.7.6-1~bpo9+1","0.7.9-0.1","0.7.9-1","0.7.9-2","0.7.9-3","0.7.9-3~bpo8+1","0.7.9-3~bpo9+1","0.8.0-1","0.8.0-2","0.8.0~rc3-1","0.8.0~rc4-1","0.8.1-1","0.8.1-2","0.8.1-3","0.8.1-4","0.8.1-4~bpo10+1","0.8.2-1","0.8.2-2","0.8.2-2~bpo10+1","0.8.2-3","0.8.2-3~bpo10+1","0.8.2-4","0.8.2-5","0.8.3-1","0.8.3-1~bpo10+1","0.8.3-2","0.8.4-1","0.8.4-1~bpo10+1","0.8.4-2","0.8.4-2~bpo10+1","0.8.5-1","0.8.5-2","0.8.5-2~bpo10+1","0.8.5-3","0.8.5-3~bpo10+1","0.8.6-1","0.8.6-1~bpo10+1","2.0.0-1~exp1","2.0.1-1","2.0.1-1~exp1","2.0.1-2","2.0.1-3","2.0.2-1","2.0.2-1~bpo10+1","2.0.3-1","2.0.3-1~bpo10+1","2.0.3-2","2.0.3-3","2.0.3-4","2.0.3-5","2.0.3-6","2.0.3-7","2.0.3-8","2.0.3-8~bpo10+1","2.0.3-9","2.0.3-9~bpo10+1","2.0.6-1","2.0.6-1~bpo10+1","2.0.6-1~bpo11+1","2.0.6-2","2.0.7-1~bpo10+1","2.1.1-1","2.1.1-2","2.1.1-3","2.1.11-1","2.1.11-1~bpo11+1","2.1.12-1","2.1.12-2","2.1.12-2~bpo12+1","2.1.13-1","2.1.13-1~bpo11+1","2.1.13-1~bpo12+1","2.1.13-2","2.1.13-2~bpo11+1","2.1.13-2~bpo12+1","2.1.14-1","2.1.14-1~bpo11+1","2.1.14-1~bpo12+1","2.1.2-1","2.1.2-1~bpo11+1","2.1.4-1","2.1.4-1~bpo11+1","2.1.5-1","2.1.5-1~bpo11+1","2.1.6-1","2.1.6-2","2.1.6-3","2.1.6-3~bpo11+1","2.1.7-1","2.1.7-1~bpo11+1","2.1.7-2","2.1.8-1","2.1.9-1","2.1.9-1~bpo11+1","2.1.9-2","2.1.9-3","2.1.9-3~bpo11+1","2.1.9-4","2.2.0-1~exp1","2.2.1-1~exp1","2.2.1-1~exp2","2.2.2-1","2.2.2-1~exp1","2.2.2-2","2.2.2-3","2.2.2-3~bpo12+1","2.2.2-4","2.2.2-4~bpo12+1","2.2.2-5~exp1","2.2.2-5~exp2","2.2.2-5~exp3","2.2.3-1","2.2.3-1~bpo12+1","2.2.3-2","2.2.3-2~bpo12+1","2.2.4-1","2.2.4-1~bpo12+1","2.2.4-2","2.2.5-1","2.2.5-1~bpo12+1","2.2.6-1","2.2.6-1~bpo12+1","2.2.6-1~bpo12+2","2.2.6-1~bpo12+3","2.2.6-2","2.2.7-1","2.2.7-1~bpo12+1","2.2.7-2","2.3.0-1","2.3.0-1~exp1","2.3.0-2","2.3.0-2~exp1","2.3.0~rc5-1~exp1","2.3.0~rc5-1~exp1.1","2.3.1-1","2.3.1-1~bpo12+1","2.3.2-1","2.3.2-2","2.3.2-2~bpo12+1","2.3.2-2~bpo12+2","2.3.3-1","2.3.3-1~bpo13+1","2.3.4-1","2.3.4-1~bpo13+1","2.3.4~git20250812.3b64a96-1","2.3.5-1","2.3.5-2","2.3.5-2~bpo13+1","2.4.0-1","2.4.0-1~bpo13+1","2.4.0-1~exp1","2.4.1-1","2.4.1-1~bpo13+1","2.4.2-1","2.4.2-1~bpo13+1","2.4.2-2","2.4.3-1","2.4.3-1~bpo13+1","2.4.3-2","2.4.3-2~bpo13+1","2.4.3-3","2.4.4-1~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.5-1ubuntu16.12+esm1"}]}],"versions":["0.6.5.11-1ubuntu3","0.6.5.11-1ubuntu4","0.6.5.11-1ubuntu5","0.6.5.11-1ubuntu6","0.7.5-1ubuntu2","0.7.5-1ubuntu3","0.7.5-1ubuntu4","0.7.5-1ubuntu5","0.7.5-1ubuntu6","0.7.5-1ubuntu7","0.7.5-1ubuntu8","0.7.5-1ubuntu9","0.7.5-1ubuntu10","0.7.5-1ubuntu11","0.7.5-1ubuntu12","0.7.5-1ubuntu13","0.7.5-1ubuntu14","0.7.5-1ubuntu15","0.7.5-1ubuntu16","0.7.5-1ubuntu16.2","0.7.5-1ubuntu16.3","0.7.5-1ubuntu16.4","0.7.5-1ubuntu16.6","0.7.5-1ubuntu16.7","0.7.5-1ubuntu16.8","0.7.5-1ubuntu16.9","0.7.5-1ubuntu16.10","0.7.5-1ubuntu16.11","0.7.5-1ubuntu16.12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.3-1ubuntu12.18+esm1"}]}],"versions":["0.8.1-1ubuntu14","0.8.1-1ubuntu15","0.8.1-1ubuntu16","0.8.1-1ubuntu17","0.8.2-3ubuntu1","0.8.2-3ubuntu2","0.8.2-3ubuntu3","0.8.2-3ubuntu4","0.8.2-3ubuntu5","0.8.3-1ubuntu2","0.8.3-1ubuntu3","0.8.3-1ubuntu4","0.8.3-1ubuntu5","0.8.3-1ubuntu6","0.8.3-1ubuntu7","0.8.3-1ubuntu8","0.8.3-1ubuntu9","0.8.3-1ubuntu10","0.8.3-1ubuntu11","0.8.3-1ubuntu12","0.8.3-1ubuntu12.1","0.8.3-1ubuntu12.2","0.8.3-1ubuntu12.3","0.8.3-1ubuntu12.4","0.8.3-1ubuntu12.5","0.8.3-1ubuntu12.6","0.8.3-1ubuntu12.7","0.8.3-1ubuntu12.8","0.8.3-1ubuntu12.9","0.8.3-1ubuntu12.10","0.8.3-1ubuntu12.11","0.8.3-1ubuntu12.12","0.8.3-1ubuntu12.13","0.8.3-1ubuntu12.14","0.8.3-1ubuntu12.15","0.8.3-1ubuntu12.16","0.8.3-1ubuntu12.17","0.8.3-1ubuntu12.18"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.5-1ubuntu6~22.04.7"}]}],"versions":["2.0.6-1ubuntu2","2.0.6-1ubuntu3","2.1.2-1ubuntu1","2.1.2-1ubuntu2","2.1.2-1ubuntu3","2.1.4-0ubuntu0.1","2.1.5-1ubuntu6~22.04.1","2.1.5-1ubuntu6~22.04.2","2.1.5-1ubuntu6~22.04.3","2.1.5-1ubuntu6~22.04.4","2.1.5-1ubuntu6~22.04.5","2.1.5-1ubuntu6~22.04.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-0ubuntu9.5"}]}],"versions":["2.2.0~rc3-0ubuntu4","2.2.0-0ubuntu1","2.2.0-0ubuntu3","2.2.1-0ubuntu1","2.2.2-0ubuntu1","2.2.2-0ubuntu2","2.2.2-0ubuntu3","2.2.2-0ubuntu4","2.2.2-0ubuntu7","2.2.2-0ubuntu8","2.2.2-0ubuntu9","2.2.2-0ubuntu9.1","2.2.2-0ubuntu9.2","2.2.2-0ubuntu9.3","2.2.2-0ubuntu9.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-1ubuntu5.1"}]}],"versions":["2.3.4-1ubuntu2","2.3.5-1ubuntu1","2.3.5-1ubuntu2","2.4.0-1ubuntu2","2.4.0-1ubuntu3","2.4.0-1ubuntu4","2.4.1-1ubuntu1","2.4.1-1ubuntu2","2.4.1-1ubuntu3","2.4.1-1ubuntu4","2.4.1-1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.5-1ubuntu6~22.04.7"}]}],"versions":["2.0.6-1ubuntu2","2.0.6-1ubuntu3","2.1.2-1ubuntu1","2.1.2-1ubuntu2","2.1.2-1ubuntu3","2.1.4-0ubuntu0.1","2.1.5-1ubuntu6~22.04.1","2.1.5-1ubuntu6~22.04.2","2.1.5-1ubuntu6~22.04.3","2.1.5-1ubuntu6~22.04.4","2.1.5-1ubuntu6~22.04.5","2.1.5-1ubuntu6~22.04.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-0ubuntu9.5"}]}],"versions":["2.2.0~rc3-0ubuntu4","2.2.0-0ubuntu1","2.2.0-0ubuntu3","2.2.1-0ubuntu1","2.2.2-0ubuntu1","2.2.2-0ubuntu2","2.2.2-0ubuntu3","2.2.2-0ubuntu4","2.2.2-0ubuntu7","2.2.2-0ubuntu8","2.2.2-0ubuntu9","2.2.2-0ubuntu9.1","2.2.2-0ubuntu9.2","2.2.2-0ubuntu9.3","2.2.2-0ubuntu9.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-1ubuntu5.1"}]}],"versions":["2.3.4-1ubuntu2","2.3.5-1ubuntu1","2.3.5-1ubuntu2","2.4.0-1ubuntu2","2.4.0-1ubuntu3","2.4.0-1ubuntu4","2.4.1-1ubuntu1","2.4.1-1ubuntu2","2.4.1-1ubuntu3","2.4.1-1ubuntu4","2.4.1-1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.5-1ubuntu16.12+esm1"}]}],"versions":["0.6.5.11-1ubuntu3","0.6.5.11-1ubuntu4","0.6.5.11-1ubuntu5","0.6.5.11-1ubuntu6","0.7.5-1ubuntu2","0.7.5-1ubuntu3","0.7.5-1ubuntu4","0.7.5-1ubuntu5","0.7.5-1ubuntu6","0.7.5-1ubuntu7","0.7.5-1ubuntu8","0.7.5-1ubuntu9","0.7.5-1ubuntu10","0.7.5-1ubuntu11","0.7.5-1ubuntu12","0.7.5-1ubuntu13","0.7.5-1ubuntu14","0.7.5-1ubuntu15","0.7.5-1ubuntu16","0.7.5-1ubuntu16.2","0.7.5-1ubuntu16.3","0.7.5-1ubuntu16.4","0.7.5-1ubuntu16.6","0.7.5-1ubuntu16.7","0.7.5-1ubuntu16.8","0.7.5-1ubuntu16.9","0.7.5-1ubuntu16.10","0.7.5-1ubuntu16.11","0.7.5-1ubuntu16.12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zfs-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.3-1ubuntu12.18+esm1"}]}],"versions":["0.8.1-1ubuntu14","0.8.1-1ubuntu15","0.8.1-1ubuntu16","0.8.1-1ubuntu17","0.8.2-3ubuntu1","0.8.2-3ubuntu2","0.8.2-3ubuntu3","0.8.2-3ubuntu4","0.8.2-3ubuntu5","0.8.3-1ubuntu2","0.8.3-1ubuntu3","0.8.3-1ubuntu4","0.8.3-1ubuntu5","0.8.3-1ubuntu6","0.8.3-1ubuntu7","0.8.3-1ubuntu8","0.8.3-1ubuntu9","0.8.3-1ubuntu10","0.8.3-1ubuntu11","0.8.3-1ubuntu12","0.8.3-1ubuntu12.1","0.8.3-1ubuntu12.2","0.8.3-1ubuntu12.3","0.8.3-1ubuntu12.4","0.8.3-1ubuntu12.5","0.8.3-1ubuntu12.6","0.8.3-1ubuntu12.7","0.8.3-1ubuntu12.8","0.8.3-1ubuntu12.9","0.8.3-1ubuntu12.10","0.8.3-1ubuntu12.11","0.8.3-1ubuntu12.12","0.8.3-1ubuntu12.13","0.8.3-1ubuntu12.14","0.8.3-1ubuntu12.15","0.8.3-1ubuntu12.16","0.8.3-1ubuntu12.17","0.8.3-1ubuntu12.18"]}],"products":[{"vendor":"openzfs","product":"openzfs"}],"references":[{"url":"https://github.com/openzfs/zfs/pull/18959","tags":["patch","fix","report"]},{"url":"https://github.com/advisories/GHSA-mhf5-q8gw-qg9v","tags":["vendor-advisory","advisory","report"]},{"url":"https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4","tags":["product","web"]},{"url":"https://github.com/openzfs/zfs/releases/tag/zfs-2.3.9","tags":["product","web"]},{"url":"https://github.com/openzfs/zfs/releases/tag/zfs-2.2.11","tags":["product","web"]},{"url":"https://seclists.org/fulldisclosure/2026/Aug/40","tags":["mailing-list","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79619","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5v2p-vxxv-r62r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79619.json","tags":["advisory"]},{"url":"https://github.com/openzfs/zfs","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-79619","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-79619","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79619","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/16/5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8705-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8705-2","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-79619","title":"OpenZFS: user-namespace capability check allows unprivileged local authorization bypass","description":"On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.","status":"published","published":"2026-08-26T12:50:10.502Z","modified":"2026-08-27T17:32:03.057Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:50:38.739766Z"}],"euvd":[{"id":"EUVD-2026-66419","description":"On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.","status":"published","published":"2026-08-26T12:50:10Z","modified":"2026-08-27T17:32:03Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:27.27583Z"}],"ghsa":[{"id":"GHSA-5v2p-vxxv-r62r","title":"On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user...","description":"On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.","status":"published","published":"2026-08-26T18:31:54Z","modified":"2026-08-27T21:32:29Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:11:05.645531Z"}],"nvd":[{"id":"CVE-2026-79619","description":"On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.","status":"published","published":"2026-08-26T13:19:24.003Z","modified":"2026-08-28T15:24:38.6Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"CVE-2026-79619","title":"OpenZFS: user-namespace capability check allows unprivileged local authorization bypass","description":"On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.","status":"published","published":"2026-08-26T12:50:10.502Z","modified":"2026-10-28T02:30:33.111728905Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"DEBIAN-CVE-2026-79619","description":"On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.","status":"published","published":"2026-08-26T13:19:24.003Z","modified":"2026-10-01T03:03:43.16178262Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:04.001673Z"},{"id":"UBUNTU-CVE-2026-79619","description":"On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.","status":"published","published":"2026-08-27T00:00:00Z","modified":"2026-09-01T09:55:50.258886643Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"USN-8705-1","title":"zfs-linux vulnerability","description":"It was discovered that OpenZFS incorrectly handled authorization checks for\ncertain ioctl operations on Linux. A local attacker could possibly use this\nissue to perform pool-administrative operations or access privileged\ninformation, resulting in an authorization bypass.","status":"published","published":"2026-08-31T12:57:46Z","modified":"2026-08-31T22:26:24.369666173Z","updated_at":"2026-11-02T16:58:26.907654Z"},{"id":"USN-8705-2","title":"zfs-linux vulnerability","description":"USN-8705-1 fixed vulnerabilities in OpenZFS. This update provides the\ncorresponding fix for OpenZFS on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\nIt was discovered that OpenZFS incorrectly handled authorization checks for\ncertain ioctl operations on Linux. A local attacker could possibly use this\nissue to perform pool-administrative operations or access privileged\ninformation, resulting in an authorization bypass.\n","status":"published","published":"2026-08-31T21:36:58Z","modified":"2026-09-01T09:56:15.947671794Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}