CVE-2026-49430
Analyzed Analyzed - Analysis Complete

ZFS Heal Receive Kernel Memory Corruption via Truncated Size

Publication date: 2026-08-19

Last updated on: 2026-09-01

Assigner: FreeBSD

Description
The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption via ZFS_IOC_RECV_NEW by sending a crafted receive stream in heal mode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-09-01
Generated
2026-09-08
AI Q&A
2026-08-19
EPSS Evaluated
2026-09-07
NVD
CVE-2026-49430
EUVD
EUVD-2026-62240

Affected Vendors & Products

Showing 38 associated CPEs
Vendor Product Version / Range
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 15.0
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 14.3
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.4
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 14.3
freebsd freebsd 14.3
freebsd freebsd 14.4
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 15.0
freebsd freebsd 14.3
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 15.1
freebsd freebsd 14.4
freebsd freebsd 15.0
freebsd freebsd 15.1
freebsd freebsd 15.1
freebsd freebsd 14.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a flaw in the ZFS_IOC_RECV_NEW ioctl during heal receive operations. A local user with 'receive' delegated ZFS permission can exploit this by sending a crafted receive stream, causing kernel memory corruption due to a 64-bit payload size being truncated to 32-bit for allocation but used as 64-bit for byteswap operations.

Detection Guidance

This vulnerability can only be detected by checking the ZFS version and patch status on the affected system. Use commands like 'zfs version' or 'pkg info zfs' to verify if the system is running a vulnerable version. Compare the version against patched releases dated after June 30, 2026.

Impact Analysis

A local attacker with 'receive' permission could trigger kernel memory corruption, potentially leading to system crashes, privilege escalation, or unauthorized access to sensitive data on systems running vulnerable OpenZFS versions.

Compliance Impact

This vulnerability could lead to unauthorized data access or system compromise, violating confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable ZFS systems may face compliance violations if data breaches occur due to this flaw.

Mitigation Strategies

Upgrade affected systems to patched ZFS versions dated after June 30, 2026, using pkg, freebsd-update, or source patches. Reboot the system after applying updates. Systems not using ZFS are unaffected and require no action.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49430. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart