CVE-2026-49430 — Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl

Description (CNA)

The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption via ZFS_IOC_RECV_NEW by sending a crafted receive stream in heal mode.

Affected (CNA)

Vendor / product	Versions
FreeBSD / FreeBSD	affected 15.1-RELEASE before p1; affected 15.0-RELEASE before p11; affected 14.4-RELEASE before p7; affected 14.3-RELEASE before p16

CWE

CWE-122

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:40.zfs.asc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.