EUVD-2026-66419
GHSA-5v2p-vxxv-r62r
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with low privilege suffices; scope changes because namespace-scoped capability escalates to host-level pool control affecting all users of shared storage.
Primary rating from Vendor (canonical).
CVSS VectorVendor: canonical
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.
AnalysisAI
Privilege escalation in OpenZFS on Linux allows any unprivileged local user to perform root-restricted ZFS pool operations - including pool creation, import, destruction, event log access, and fault injection via zinject - by exploiting a flaw in ioctl authorization that incorrectly treats CAP_SYS_ADMIN held within a user-created unprivileged namespace as equivalent to real host-level root privilege. The vulnerability requires only that the user can open /dev/zfs and that the kernel permits unprivileged user namespace creation, a configuration that is enabled by default on most modern Linux distributions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must both be true simultaneously. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.3 with vector AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H reflects accurate severity: local access with low privilege suffices, there is no user interaction, and all three CIA pillars are high within the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unprivileged user on a multi-user Linux server runs 'unshare -Ur zpool destroy tank' from their shell session. Within the new user namespace, the kernel grants them CAP_SYS_ADMIN scoped to that namespace; OpenZFS's ioctl handler accepts this as sufficient authorization and proceeds to destroy the production ZFS pool 'tank' without any further authentication. … |
| Remediation | Upgrade OpenZFS to version 2.4.4 (if on the 2.4.x branch), 2.3.9 (2.3.x branch), or 2.2.11 (2.2.x branch) from the tagged releases at https://github.com/openzfs/zfs/releases. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Linux systems running OpenZFS to identify deployment scope, versions, and exposure; verify whether unprivileged user namespace creation is enabled on each system. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by
OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories. Rated high severity (CVS
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficien
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today