CVE-2026-49429
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel heap overflow via the ZFS_IOC_USERSPACE_MANY ioctl, potentially escalating privileges.
Risk Assessment
Kernel heap overflow may allow a local user to escalate privileges and gain control of the system.
Recommendation
Apply the vendor patch that fixes the size truncation in the ZFS_IOC_USERSPACE_MANY ioctl. Update the system to a patched version.
Original NVD description (English source)
The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel heap overflow via the ZFS_IOC_USERSPACE_MANY ioctl, potentially escalating privileges.