CVE-2026-49429: Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl
The ZFSIOCUSERSPACEMANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records.
A local user with the "userused" delegated ZFS permission can trigger a kernel heap overflow via the ZFSIOCUSERSPACEMANY ioctl, potentially escalating privileges.
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to exploitation?
A local user must have the delegated ZFS "userused" permission. The issue can potentially be used to escalate privileges from that level of local access.
What operation triggers the overflow?
The overflow is triggered through the ZFS_IOC_USERSPACE_MANY ioctl, which is used by zfs-userspace(8). An attacker supplies an output buffer size that is truncated to 32 bits for allocation but retained as a 64-bit limit while records are written.