Kernel Memory Corruption in ZFS by FreeBSD
CVE-2026-49430

7.8HIGH

Key Information:

Vendor

FreeBSD

Status
FreeBSD
Vendor
CVE Published:
19 August 2026

What is CVE-2026-49430?

A vulnerability in ZFS, specifically within the ZFS_IOC_RECV_NEW ioctl during the heal receive path, allows local users with receive delegated ZFS permissions to induce kernel memory corruption. This occurs when a crafted receive stream is sent in heal mode, leading to a truncation of a 64-bit payload size to a 32-bit integer used for allocation. The operation subsequently attempts to use the original 64-bit size for a byteswap operation, creating potential stability and security risks within the system.

Affected Version(s)

FreeBSD 15.1-RELEASE

FreeBSD 15.0-RELEASE

FreeBSD 14.4-RELEASE

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:40....
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai
Emmanuel Genier at Quarkslab
.