Description (CNA)
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenZFS / OpenZFS | affected 0.7.0 before 2.2.11; affected 2.3.0 before 2.3.9; affected 2.4.0 before 2.4.4 |
CWE
CWE-863
References
- https://github.com/openzfs/zfs/pull/18959
- https://github.com/advisories/GHSA-mhf5-q8gw-qg9v
- https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4
- https://github.com/openzfs/zfs/releases/tag/zfs-2.3.9
- https://github.com/openzfs/zfs/releases/tag/zfs-2.2.11
- https://seclists.org/fulldisclosure/2026/Aug/40
ADP enrichment
No English description supplied.
No references supplied.