Description

The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel heap overflow via the ZFS_IOC_USERSPACE_MANY ioctl, potentially escalating privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-19T06:17:42.513Z",
  "pubdate": "2026-08-19T06:17:42.513Z",
  "executiveSummary": "A kernel heap overflow vulnerability exists in the ZFS filesystem implementation, specifically within the ZFS_IOC_USERSPACE_MANY ioctl invoked by zfs-userspace(8).\nThe vulnerability arises due to an integer truncation flaw where a 64-bit output buffer size is improperly cast to a 32-bit integer for kernel memory allocation, while the original 64-bit size is retained for boundary checks during record writing.\nA local attacker possessing the \"userused\" delegated ZFS permission can successfully trigger this heap-based buffer overflow.\nSuccessful exploitation of this flaw can lead to kernel memory corruption, potentially allowing the attacker to achieve local privilege escalation and compromise the integrity and availability of the affected system.",
  "technicalDetails": "The root cause of the vulnerability resides in improper data type handling within the ZFS_IOC_USERSPACE_MANY ioctl handling routine.\nWhen processing user-supplied data, the interface takes a 64-bit output buffer size but truncates this value down to a 32-bit integer when calculating the necessary kernel heap allocation size.\nHowever, subsequent logic utilizes the original 64-bit size as the buffer limit when writing records into the allocated memory region.\nThis mismatch between the allocated buffer size (truncated to 32 bits) and the write limit (retained as 64 bits) results in a classic heap-based buffer overflow condition.\nTo trigger the vulnerability, an unprivileged local user must be granted the specific \"userused\" delegated ZFS permission.\nThe attack flow proceeds as follows: 1) The local user opens the ZFS control device and issues the ZFS_IOC_USERSPACE_MANY ioctl. 2) The user supplies crafted parameters containing a large 64-bit buffer size that bypasses allocation constraints after being truncated to 32 bits. 3) The kernel allocates a smaller-than-expected heap buffer based on the truncated 32-bit value. 4) The kernel proceeds to write records up to the original 64-bit boundary limit, thereby overflowing the heap-allocated destination buffer.\nThis memory corruption can overwrite adjacent kernel heap structures, leading to unpredictable system behavior, denial of service, or the potential execution of arbitrary code in kernel space, effectively enabling privilege escalation."
}