CVE-2026-49429

Name of the Vulnerable Software and Affected Versions OpenZFS (affected versions not specified)

Description A kernel heap overflow exists in the zfs ioc userspace many() function within the ZFS IOC USERSPACE MANY ioctl used by zfs-userspace(8). The issue occurs because a 64-bit output buffer size is truncated to a 32-bit integer during kernel allocation, while the original 64-bit size is still used as the buffer limit when writing records. A local user possessing the userused delegated ZFS permission can exploit this to potentially escalate privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.