CVE-2026-49429 PUBLISHED

Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl

Assigner: freebsd
Reserved: 29.05.2026 Published: 19.08.2026 Updated: 19.08.2026

The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records.

A local user with the "userused" delegated ZFS permission can trigger a kernel heap overflow via the ZFS_IOC_USERSPACE_MANY ioctl, potentially escalating privileges.

Product Status

Vendor FreeBSD
Product FreeBSD
Versions Default: unknown
  • affected from 15.1-RELEASE to p1 (excl.)
  • affected from 15.0-RELEASE to p11 (excl.)
  • affected from 14.4-RELEASE to p7 (excl.)
  • affected from 14.3-RELEASE to p16 (excl.)

Credits

  • Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai finder
  • Emmanuel Genier at Quarkslab finder

References

Problem Types

  • CWE-122: Heap-based Buffer Overflow CWE