https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:41:46 +0000 https://vulnerability.circl.lu/vuln/cve-2026-79619 <p><strong>Affected:</strong> OpenZFS</p> <p>On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.</p> <p><strong>Affected:</strong> OpenZFS</p> <p>On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.</p> https://vulnerability.circl.lu/vuln/cve-2026-79619 https://vulnerability.circl.lu/vuln/usn-8705-1 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: zfs-linux, Ubuntu:24.04:LTS: zfs-linux, Ubuntu:26.04:LTS: zfs-linux</p> <p>It was discovered that OpenZFS incorrectly handled authorization checks for certain ioctl operations on Linux. A local attacker could possibly use this issue to perform pool-administrative operations or access privileged information, resulting in an authorization bypass.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: zfs-linux, Ubuntu:24.04:LTS: zfs-linux, Ubuntu:26.04:LTS: zfs-linux</p> <p>It was discovered that OpenZFS incorrectly handled authorization checks for certain ioctl operations on Linux. A local attacker could possibly use this issue to perform pool-administrative operations or access privileged information, resulting in an authorization bypass.</p> https://vulnerability.circl.lu/vuln/usn-8705-1