CVE-2026-49430
Low risk· EPSS 10%Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption via ZFS_IOC_RECV_NEW by sending a crafted receive stream in heal mode.
Risk Assessment
A local user with appropriate permissions can cause kernel memory corruption, potentially leading to system crash or privilege escalation.
Recommendation
Apply the vendor patch that fixes the size truncation in the ZFS_IOC_RECV_NEW ioctl. Update the system to a patched version.
Original NVD description (English source)
The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption via ZFS_IOC_RECV_NEW by sending a crafted receive stream in heal mode.