CVE-2026-49430: ZFS Privilege Escalation Vulnerability

CVE-2026-49430 Overview

CVE-2026-49430 is a heap-based memory corruption vulnerability in the FreeBSD ZFS ZFS_IOC_RECV_NEW ioctl. The heal receive path truncates a 64-bit payload size to a 32-bit integer when allocating a buffer. It then uses the original 64-bit size as the length parameter for a subsequent byteswap operation. This size mismatch produces an out-of-bounds write into kernel memory. A local user holding the receive delegated ZFS permission can exploit the flaw by supplying a crafted receive stream in heal mode. The weakness is classified under CWE-122 (Heap-based Buffer Overflow).

Critical Impact
A local user with the delegated ZFS receive permission can trigger kernel heap corruption, enabling denial of service or potential privilege escalation on affected FreeBSD systems.

Affected Products

FreeBSD operating system ZFS subsystem (see the FreeBSD Security Advisory for exact affected releases)
OpenZFS ZFS_IOC_RECV_NEW ioctl implementation
Systems where users hold the receive delegated ZFS permission

Discovery Timeline

2026-08-19 - CVE-2026-49430 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-49430

Vulnerability Analysis

The vulnerability resides in the heal receive code path invoked through the ZFS_IOC_RECV_NEW ioctl. Two distinct integer widths describe the same payload during processing. The allocation routine casts the payload size from 64-bit to 32-bit, silently discarding the upper bits when the value exceeds UINT32_MAX. The subsequent byteswap operation still references the original 64-bit length. This creates a length-versus-buffer mismatch: the destination allocation is small, but the operation writes according to the untruncated 64-bit value. The result is a heap-based buffer overflow inside the kernel, matching the CWE-122 pattern.

Root Cause

The root cause is a numeric truncation error at the allocation site. Developers mixed a 64-bit uint64_t payload size with a 32-bit allocator argument without validating that the value fit in the smaller type. Because the byteswap consumer received the unmodified 64-bit length, size validation was inconsistent between producer and consumer of the same buffer. Any receive stream declaring a payload larger than 4 GiB triggers the divergence.

Attack Vector

Exploitation requires local access and possession of the receive delegated ZFS permission on a dataset. The attacker crafts a ZFS receive stream in heal mode with a payload header specifying a size greater than 0xFFFFFFFF. Submitting the stream via ZFS_IOC_RECV_NEW causes the kernel to allocate a truncated buffer, then byteswap far past its end. The overflow corrupts adjacent kernel heap objects. Depending on the surrounding allocator state, an attacker may achieve kernel panic or manipulate kernel data structures for privilege escalation. See the FreeBSD Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-49430

Indicators of Compromise

Unexpected kernel panics or system crashes referencing ZFS receive code paths such as zfs_ioc_recv_new or heal receive handlers.
Kernel core dumps showing heap corruption during ZFS receive operations initiated by non-root users.
Audit records showing invocation of zfs receive by users holding delegated receive permissions on unusual datasets.

Detection Strategies

Monitor devd and kernel logs for repeated ZFS-related faults tied to a specific user session.
Audit ZFS delegation with zfs allow to enumerate every principal granted the receive permission.
Alert on ZFS_IOC_RECV_NEW ioctl usage combined with heal mode flags in receive streams captured through DTrace or auditd.

Monitoring Recommendations

Enable FreeBSD audit (auditd) with AUE_ioctl events to capture ioctl activity against /dev/zfs.
Track process execution of zfs receive invocations, particularly with the -c heal flag, and correlate with the invoking UID.
Baseline normal ZFS receive volumes and flag streams that declare payload headers exceeding 4 GiB.

How to Mitigate CVE-2026-49430

Immediate Actions Required

Apply the FreeBSD patches referenced in FreeBSD-SA-26:40.zfs to all affected hosts.
Revoke the receive delegated ZFS permission from any account that does not strictly require it.
Restrict local shell access on ZFS servers to trusted administrators until patches are deployed.

Patch Information

FreeBSD has published fixes through the FreeBSD Security Advisory system. Administrators should consult the FreeBSD Security Advisory for the exact patch commits, affected release branches, and update procedures using freebsd-update or source rebuild instructions.

Workarounds

Remove the receive permission from delegated ZFS ACLs using zfs unallow <user> receive <dataset> where feasible.
Restrict access to the /dev/zfs device node so only privileged administrators can invoke ZFS ioctls.
Disable acceptance of untrusted receive streams and only ingest streams generated by trusted senders.

bash

# Enumerate and remove delegated receive permissions
zfs allow tank
zfs unallow <user> receive tank/<dataset>

# Apply FreeBSD security updates
freebsd-update fetch
freebsd-update install