CVE-2026-79619

Name of the Vulnerable Software and Affected Versions OpenZFS (affected versions not specified)

Description On Linux, several ioctl authorization checks incorrectly treat capabilities held within a user-created, unprivileged namespace as equivalent to actual host privileges. This allows an unprivileged local user to execute operations that typically require root access, such as pool-administrative tasks (create, import, destroy), accessing the pool event log via zpool events, and performing fault injection through zinject. Exploitation is possible if the local user can open /dev/zfs and the kernel allows the creation of unprivileged user namespaces. No prior access to the target pool or its underlying devices is required.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.