Executive brief
OpenZFS on Linux accepts certain security permissions granted within unprivileged user namespaces as if they were true system administrator privileges. This allows unprivileged users to perform administrative operations on storage pools (create, import, destroy), access pool event logs, and inject faults—operations that should require root-level access. An attacker needs only the ability to open /dev/zfs and create user namespaces, both commonly available to regular system users.
Technical details
This vulnerability is a privilege escalation flaw in OpenZFS ioctl authorization checks on Linux. The root cause is that the security policy layer (secpolicy zone checks) incorrectly treats capabilities held within a user-created unprivileged namespace as equivalent to host-level root privilege. An attacker exploits this by creating an unprivileged user namespace, gaining elevated capabilities within that namespace, and then using ioctl calls to perform privileged operations such as zpool create/import/destroy, zpool events, and zinject. No prior access to the target pool or underlying block devices is required—only the ability to open /dev/zfs (governed by local device permissions) and permission to create user namespaces. A patch has been proposed via GitHub PR #18959 to tighten the secpolicy zone checks.
Affected products
- OpenZFS ZFS <unknown>
Timeline
- 2026-08-26: disclosed
- 2026-08-20: other: GitHub PR #18959 submitted with fix for tightening secpolicy zone checks