{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0.7.0"
              },
              {
                "fixed": "2.2.11"
              },
              {
                "introduced": "2.3.0"
              },
              {
                "fixed": "2.3.9"
              },
              {
                "introduced": "2.4.0"
              },
              {
                "fixed": "2.4.4"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "ccad64314ab55963c1a0731ff62c8cf6c6976f28"
            },
            {
              "introduced": "bc06d8164b8b6673ca2dc9b36090f91a5d6348b3"
            },
            {
              "introduced": "743334913e5a5f60baf287bcc6d8a23515b02ac5"
            },
            {
              "fixed": "f2d87f5c724ccdbb27a11fb84c4a185e0a917598"
            },
            {
              "fixed": "4c0eb7203e5a2b147d1d5e27b5e2a3461a95c1dc"
            },
            {
              "fixed": "71a9f9578616a90c3c14bb59629fb4d31bfd68d1"
            }
          ],
          "repo": "https://github.com/openzfs/zfs",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-mhf5-q8gw-qg9v"
  ],
  "database_specific": {
    "cna_assigner": "canonical",
    "cwe_ids": [
      "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79619.json"
  },
  "details": "On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.",
  "id": "CVE-2026-79619",
  "modified": "2026-08-30T03:30:49.336807640Z",
  "published": "2026-08-26T12:50:10.502Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.2.11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.3.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79619.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-mhf5-q8gw-qg9v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79619"
    },
    {
      "type": "FIX",
      "url": "https://github.com/openzfs/zfs/pull/18959"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openzfs/zfs"
    },
    {
      "type": "ARTICLE",
      "url": "https://seclists.org/fulldisclosure/2026/Aug/40"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenZFS: user-namespace capability check allows unprivileged local authorization bypass"
}