CVE-2026-49430 — Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl
The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the len…
Published: 2026-08-19 · CVSS: 7.8 · CVSS 3.1
The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption via ZFS_IOC_RECV_NEW by sending a crafted receive stream in heal mode.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7