جزئیات آسیب‌پذیری

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.

• https://github.com/openzfs/zfs/pull/18959 patch
• https://github.com/advisories/GHSA-mhf5-q8gw-qg9v vendor-advisory
• https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4 product
• https://github.com/openzfs/zfs/releases/tag/zfs-2.3.9 product
• https://github.com/openzfs/zfs/releases/tag/zfs-2.2.11 product
• https://seclists.org/fulldisclosure/2026/Aug/40 mailing-list