CVE-2026-49429 — Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl

Description (CNA)

The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel heap overflow via the ZFS_IOC_USERSPACE_MANY ioctl, potentially escalating privileges.

Affected (CNA)

Vendor / product	Versions
FreeBSD / FreeBSD	affected 15.1-RELEASE before p1; affected 15.0-RELEASE before p11; affected 14.4-RELEASE before p7; affected 14.3-RELEASE before p16

CWE

CWE-122

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:40.zfs.asc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.