665 matches found
CVE-2026-49430
The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...
CVE-2026-49431 Incorrect user validation in ZFS_IOC_SET_PROP ioctl
The ZFSIOCSETPROP ioctl, used by zfs-set8, incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv8 stream. Any local user can set the internal ZFS metadata flag "$hasrecvd" on...
CVE-2026-49431
The OpenZFS component in FreeBSD contains an access control deficiency in the ZFS_IOC_SET_PROP ioctl handler, used by zfs-set(8) . This flaw allows an unprivileged local user to incorrectly set the internal ZFS metadata flag $hasrecvd on a dataset, falsely indicating that the dataset received pro...
CVE-2026-49431 Incorrect user validation in ZFS_IOC_SET_PROP ioctl
The ZFSIOCSETPROP ioctl, used by zfs-set8, incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv8 stream. Any local user can set the internal ZFS metadata flag "$hasrecvd" on...
EUVD-2026-62241
The ZFSIOCSETPROP ioctl, used by zfs-set8, incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv8 stream. Any local user can set the internal ZFS metadata flag "$hasrecvd" on...
CVE-2026-49430 Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl
The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...
CVE-2026-49430 Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl
The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...
EUVD-2026-62240
The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...
CVE-2026-49430
The OpenZFS component in FreeBSD contains a kernel memory corruption vulnerability (integer overflow) within the ZFS_IOC_RECV_NEW ioctl in the heal receive path. The issue arises because a 64-bit payload size is truncated to a 32-bit integer for memory allocation, but the original 64-bit size is ...
CVE-2026-49429
A kernel heap overflow exists in the OpenZFS component of FreeBSD operating systems. The vulnerability is triggered via the ZFS_IOC_USERSPACE_MANY ioctl (used by zfs-userspace(8)), where a 64-bit output buffer size is truncated to a 32-bit integer for kernel allocation, but the original 64-bit si...
EUVD-2026-62239
The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel he...
CVE-2026-49429 Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl
The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel he...
CVE-2026-49429 Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl
The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel he...
CVE-2026-49431: Incorrect Authorization
The ZFSIOCSETPROP ioctl, used by zfs-set8, incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv8 stream. Any local user can set the internal ZFS metadata flag "$hasrecvd" on...
CVE-2026-49429: Heap-based Buffer Overflow
The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel he...
CVE-2026-49430: Heap-based Buffer Overflow
The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...
FreeBSD Security Advisory - FreeBSD-SA-26:40.zfs
FreeBSD Security Advisory - The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. The ZFSIOCRECVNEW ioctl, in the heal receive path,...
FreeBSD-SA-26:40.zfs
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:40.zfs Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in OpenZFS Category: contrib Module: openzfs Announced: 2026-06-30 Credits:...
PT-2026-71931
Name of the Vulnerable Software and Affected Versions OpenZFS affected versions not specified Description An integer overflow exists in the ZFS IOC RECV NEW ioctl within the heal receive path. The issue occurs when a 64-bit payload size is truncated to a 32-bit integer during allocation, while th...
