OpenZFS 2.4.4 landed on August 21 alongside maintenance releases 2.3.9 and 2.2.11, pulling in 967 commits that tighten security, fix long-standing cache bugs, and add Linux kernel 7.2 support. The release enforces strict caller credential checks across virtual device layers and locks down zone-level isolation, meaning unprivileged containers can no longer bypass capability requirements when touching block devices. Administrators get a new zhack mmp reclaim command to recover pools stranded by Multi-Mirror Protocol failures, while a sweep of PRs finally resolves five years of tangled L2ARC rebuild logic and infinite loop issues. Multi-tenant workflows also benefit from the new send:encrypted delegation permission and cleaner POSIX ACL cache behavior after dataset rollbacks, making this one of the most polished storage updates in the project's history.

OpenZFS 2.4.4 Lands With Security Hardening, Pool Recovery Tools, and Years of L2ARC Fixes

The August 21 release ships alongside maintenance branches 2.3.9 and 2.2.11, addressing clustered storage headaches and multi-tenant permission gaps.

OpenZFS 2.4.4 is here, and it brings some of the most meaningful storage layer improvements the project has shipped in years. Released on August 21 by maintainer Tony Hutter, the new version closes a long-running security gap around device access, adds a zhack command to recover stranded ZFS pools, and finally resolves five years of tangled L2ARC rebuild bugs.

The project notes state that the 967 commits pulled into master "reflect a substantial stabilization period before the cut." If you are still running older kernel versions, you are covered with zfs-2.3.9 and zfs-2.2.11, both published on the same day. That triple release schedule is exactly the kind of backward compatibility commitment that keeps production storage admins awake at night in a good way.

Security and Pool Recovery Take Center Stage

The headline change is straightforward. ZFS previously opened block devices and files in several code paths without strictly verifying caller credentials. That changed with the new credential-based device access checks across vdev_disk, vdev_file, and the underlying zfs_file_open entry points. Unprivileged containers and unmasked processes can no longer sneak past CAP_SYS_ADMIN checks when touching virtual device layers.

Zone-level isolation got a similar treatment. secpolicy_sys_config and secpolicy_zinject now strictly require a global zone credential, meaning unprivileged containers can no longer query or inject ZFS metadata. The unused secpolicy_nfs function was purged along the way.

Then there is the new zhack mmp reclaim subcommand. If you have ever watched a multi-controller cluster strand a pool because Multi-Mirror Protocol rejected a perfectly valid uberblock, this command is going to save you a long night. It recovers pools that fail uberblock claims due to stale remote activity detection, and the underlying logic now better distinguishes between actual failures and normal cross-node writes.

L2ARC, Encryption, and Kernel Compatibility

The L2ARC fixes are arguably the most satisfying part of this release. PR #18827 bounds the rebuild sweep by the write hand on the first pass, which finally prevents the infinite loops and boundary calculation errors that have plagued the cache layer since issue #3114 opened in 2017. Five related tickets got closed in the same sweep. Systems relying on ZIL/SLOG as an L2ARC fallback should see noticeably more deterministic rebuild behavior going forward.

Multi-tenant workflows get a boost from the new send:encrypted delegation permission. It lets administrators grant snapshot send rights on encrypted datasets without handing over full pool access, slotting neatly alongside the existing send and send_encrypted namespaces.

Linux kernel support now stretches from 4.18 up to 7.2. The 7.2 add-on converts the superblock setup to sget_fc(), while broader compatibility patches cover API changes across kernels 6.3 through 6.18. CI runners also got bumped to FreeBSD 15.1 RELEASE and Alpine 3.24.1, which keeps the test matrix current.

The changelog is packed with older bugs finally getting fixed. DDT pruning got corrected for negative time overflows and insufficient locking, and zfs_write() no longer loops infinitely when it hits an unfaultable buffer. Stale POSIX ACL caches after dataset rollback are gone, and direct I/O verify events now respect rate limiting instead of flooding logs. The test suite got a substantial overhaul to match, with new coverage for device access permissions, MMP reclaim, degraded mirror claims, and encrypted dataset delegation.

It is a lot of ground to cover in a single release. The security hardening is exactly the kind of defense-in-depth work storage admins have been asking for, and fixing the L2ARC rebuild logic is a quiet win that will pay off for anyone running read-heavy workloads. Five years of tangled bugs. Gone. The pool recovery tooling alone justifies the upgrade for anyone running clustered ZFS.

You can grab the source tarball directly from the GitHub releases page, or pull the prebuilt packages from the official OpenZFS documentation site. The 2.3.9 and 2.2.11 branches are available if your production stack still relies on older kernels. Keep an eye on the project roadmap if you are tracking the next stable cut.