CVE-2026-49430

HighCVSS 7.8/10Last modified Nov 9, 2026

Description

The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation.

A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption via ZFS_IOC_RECV_NEW by sending a crafted receive stream in heal mode.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
FreeBSD	FreeBSD	>= 15.1-RELEASE, < p1; >= 15.0-RELEASE, < p11; >= 14.4-RELEASE, < p7; >= 14.3-RELEASE, < p16

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:40.zfs.ascVendor Advisory

Timeline

Published: Aug 19, 2026
Last modified: Nov 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-494313.3The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadat CVE-2026-494327.5Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that CVE-2026-494335.0The DeepAI endpoint 'https://api.deepai.org/change_user_email' accepts POST requests without any CSRF protection. If an attacker can trick a CVE-2026-494347.5Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to pub CVE-2026-494359.8Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a spe CVE-2026-494367.3LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) ac CVE-2026-494394.3OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with CVE-2026-49448.8vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementat CVE-2026-494407.4Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and cryp CVE-2026-494419.1Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the n CVE-2026-494425.3Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an atta CVE-2026-494438.8authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a