CVE-2026-49429: ZFS Privilege Escalation Vulnerability

CVE-2026-49429 Overview

CVE-2026-49429 is a kernel heap overflow vulnerability in the OpenZFS ZFS_IOC_USERSPACE_MANY ioctl used by zfs-userspace(8) on FreeBSD. The ioctl truncates a 64-bit output buffer size to a 32-bit integer when performing the kernel allocation, but retains the original 64-bit size as the buffer limit when writing records. This size mismatch produces an out-of-bounds heap write in kernel memory [CWE-122].

A local user holding the userused delegated ZFS permission can trigger the overflow and potentially escalate privileges on the affected system.

Critical Impact
A local, low-privileged user with userused delegated permission can corrupt kernel heap memory through ZFS_IOC_USERSPACE_MANY, leading to privilege escalation on FreeBSD systems using ZFS.

Affected Products

FreeBSD (ZFS subsystem) as documented in FreeBSD Security Advisory SA-26:40
OpenZFS zfs-userspace(8) interface exposing ZFS_IOC_USERSPACE_MANY
Systems that grant the userused delegated ZFS permission to non-root users

Discovery Timeline

2026-08-19 - CVE-2026-49429 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-49429

Vulnerability Analysis

The ZFS_IOC_USERSPACE_MANY ioctl returns user-space accounting records to callers of zfs-userspace(8). The caller supplies a 64-bit buffer size describing how many bytes the kernel may write back. During request handling, the kernel narrows this 64-bit value to a 32-bit integer when it calls the allocator, but continues to use the untruncated 64-bit value as the write limit when populating records.

When the caller specifies a size larger than UINT32_MAX, the low 32 bits determine the allocation, while the full value governs the copy loop. The kernel then writes past the end of the allocated heap object, producing an out-of-bounds write in a kernel allocation.

Exploitation requires local access and the userused delegated ZFS permission. Because the write occurs in kernel heap memory, an attacker who shapes adjacent allocations can overwrite kernel data structures and escalate to root.

Root Cause

The root cause is a numeric truncation error between the allocation path and the bounds-check path. The kernel uses two different integer widths for what should be a single, canonical buffer size. This is a classic size-parameter confusion pattern that maps to CWE-122 (Heap-based Buffer Overflow).

Attack Vector

The attack vector is local. An authenticated user with userused delegated permission issues a crafted ZFS_IOC_USERSPACE_MANY ioctl on a ZFS dataset, supplying a buffer size where the 64-bit value exceeds the 32-bit truncated allocation size. The kernel writes user-space accounting records past the allocated region. See the FreeBSD Security Advisory SA-26:40 for the full technical description.

No verified public exploit code is available for CVE-2026-49429 at the time of publication.

Detection Methods for CVE-2026-49429

Indicators of Compromise

Unexpected kernel panics or page faults referencing ZFS user-space accounting functions in /var/log/messages or the console log.
Processes owned by non-root users invoking zfs userspace or issuing ZFS_IOC_USERSPACE_MANY ioctls against datasets they do not administer.
Grants of the userused delegated permission to accounts that do not require it, visible via zfs allow <dataset>.

Detection Strategies

Audit ZFS delegation configuration on every pool and dataset and flag any assignment of userused to non-administrative users.
Monitor kernel crash reports and core dumps for stack traces that include OpenZFS user-space accounting routines.
Log and review zfs/zpool command invocations from unprivileged shells using auditd or FreeBSD auditdistd.

Monitoring Recommendations

Forward FreeBSD audit logs and kernel messages to a centralized log platform for correlation and retention.
Alert on repeated ioctl failures or kernel oops events on hosts that expose ZFS datasets to multi-user workloads.
Track configuration drift on ZFS delegated permissions using a scheduled zfs allow inventory.

How to Mitigate CVE-2026-49429

Immediate Actions Required

Apply the FreeBSD update referenced in FreeBSD Security Advisory SA-26:40 to all systems running ZFS.
Revoke the userused delegated permission from any account that does not strictly require it.
Inventory ZFS datasets shared with untrusted or multi-tenant users and restrict access until patching is complete.

Patch Information

FreeBSD has released a security update addressing the truncation defect in the ZFS_IOC_USERSPACE_MANY handler. Refer to FreeBSD Security Advisory SA-26:40 for supported branches, patch levels, and installation procedures using freebsd-update or source-based rebuilds.

Workarounds

Remove the userused delegated permission from non-administrative users with zfs unallow <user> userused <dataset> until patches are deployed.
Restrict access to zfs-userspace(8) on shared systems using file permissions or mandatory access control policies.
Limit local shell access on hosts that host ZFS datasets to trusted administrators.

bash

# Review current delegated ZFS permissions on a dataset
zfs allow tank/data

# Remove the vulnerable 'userused' delegation for a specific user
zfs unallow -u alice userused tank/data

# Apply the FreeBSD security update after review
freebsd-update fetch
freebsd-update install