https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:24:28 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-360234 EUVD-2026-360234 https://cve.radiocsirt.org/vuln/euvd-2026-360234 https://cve.radiocsirt.org/vuln/fkie_cve-2026-79619 <p>On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.</p> <p>On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-79619 https://cve.radiocsirt.org/vuln/ghsa-5v2p-vxxv-r62r <p>On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.</p> <p>On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.</p> https://cve.radiocsirt.org/vuln/ghsa-5v2p-vxxv-r62r https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-79619 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: zfs-linux, Ubuntu:Pro:20.04:LTS: zfs-linux, Ubuntu:22.04:LTS: zfs-linux, Ubuntu:24.04:LTS: zfs-linux, Ubuntu:26.04:LTS: zfs-linux</p> <p>On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: zfs-linux, Ubuntu:Pro:20.04:LTS: zfs-linux, Ubuntu:22.04:LTS: zfs-linux, Ubuntu:24.04:LTS: zfs-linux, Ubuntu:26.04:LTS: zfs-linux</p> <p>On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-79619