Cloudanix VulnDB

CVE-2026-79619

None

CVSS

—

EPSS

—

Published

Aug 26, 2026

CISA due date

—

The record

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities