CVE-2026-49429 in ZFS
Summary
by MITRE • 08/19/2026
The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records.
A local user with the "userused" delegated ZFS permission can trigger a kernel heap overflow via the ZFS_IOC_USERSPACE_MANY ioctl, potentially escalating privileges.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in the ZFS file system involves a critical type truncation error within the ZFS_IOC_USERSPACE_MANY ioctl interface, which is utilized by the zfs-userspace utility to retrieve disk usage statistics for specific users or groups. This operation requires the invoking process to possess the userused delegated permission on the target dataset, allowing local users with this privilege level to interact directly with kernel-space memory management routines during quota and accounting operations. The core technical flaw stems from a mismatch in data type handling between the application layer and the kernel implementation of the ioctl handler. Specifically, when processing requests for multiple user or group space records, the system allocates a buffer on the kernel heap based on a 32-bit integer representation of the requested output size. However, subsequent logic that writes the actual record data into this allocated buffer continues to use the original 64-bit value as the boundary limit for writing operations.
This discrepancy creates a classic integer truncation scenario where the allocation size is significantly smaller than the write limit if the original request exceeds four gigabytes or involves large cumulative user quotas that result in a 32-bit overflow when cast down. Because the kernel allocates memory based on the truncated 32-bit value, it reserves only a fraction of the space required by the full 64-bit length. When the system proceeds to populate this undersized buffer with data corresponding to the larger original size, it writes beyond the bounds of the allocated heap region. This results in a kernel heap overflow, corrupting adjacent memory structures and potentially overwriting critical control data such as function pointers or object headers within the kernel address space.
The operational impact of this vulnerability is severe due to its potential for local privilege escalation. An attacker with access to a ZFS dataset possessing userused delegation can craft specific ioctl requests that trigger this overflow condition. By carefully controlling the heap layout and exploiting the memory corruption, an unprivileged user can execute arbitrary code within the kernel context. This effectively bypasses standard operating system security boundaries, granting the attacker root-level privileges or equivalent control over the underlying host system. Such exploitation allows for complete compromise of data integrity, confidentiality, and availability on systems relying on ZFS with this specific configuration and permission model.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound, specifically manifesting as an out-of-bounds write due to improper size calculation during memory allocation. It also maps closely to CWE-787 Out-of-bounds Write in the context of kernel heap exploitation techniques. In terms of adversary behavior and detection frameworks, this vulnerability facilitates privilege escalation tactics described under MITRE ATT&CK technique T1068 Exploitation for Privilege Escalation. Attackers would likely leverage local access to trigger the ioctl call as part of a broader campaign to gain persistent control over compromised systems or pivot to other networked assets after achieving elevated privileges.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is applying vendor-provided patches that correct the type casting logic within the ZFS_IOC_USERSPACE_MANY handler, ensuring that buffer allocation sizes strictly match the actual data write limits regardless of input magnitude. System administrators should also enforce strict least-privilege principles by auditing which users or groups hold userused delegation permissions on sensitive datasets. Limiting these delegations to trusted administrative accounts reduces the attack surface available for local exploitation. Furthermore, enabling kernel hardening features such as KASLR and stack canaries may mitigate successful code execution attempts even if the overflow occurs, although patching remains the only definitive solution. Regular updates of ZFS components are essential to maintain resilience against this class of memory corruption vulnerabilities in enterprise storage environments.