Kernel Heap Overflow in ZFS Userspace Management by FreeBSD
CVE-2026-49429

7.8HIGH

Key Information:

Vendor

FreeBSD

Status
FreeBSD
Vendor
CVE Published:
19 August 2026

What is CVE-2026-49429?

A local user with delegated 'userused' ZFS permission can exploit a vulnerability in the ZFS_IOC_USERSPACE_MANY ioctl by sending a truncated 64-bit output buffer request. This discrepancy between the kernel's allocation of a 32-bit integer for the output buffer size and the original 64-bit size used as the buffer limit allows the user to potentially trigger a kernel heap overflow, leading to unauthorized privilege escalation.

Affected Version(s)

FreeBSD 15.1-RELEASE

FreeBSD 15.0-RELEASE

FreeBSD 14.4-RELEASE

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:40....
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Emmanuel Genier at Quarkslab
.