CVE-2026-49429

A kernel heap overflow exists in the OpenZFS component of FreeBSD operating systems. The vulnerability is triggered via the ZFS_IOC_USERSPACE_MANY ioctl (used by zfs-userspace(8)), where a 64-bit output buffer size is truncated to a 32-bit integer for kernel allocation, but the original 64-bit si...

EUVD-2026-62239

The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace8, truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel he...