ZFS Kernel Heap Overflow via Userspace Buffer Truncation

CVE-2026-49429 is a heap overflow vulnerability in ZFS's ZFS_IOC_USERSPACE_MANY ioctl handler that stems from a type mismatch: a 64-bit buffer size is truncated to 32-bit for kernel memory allocation, but the original 64-bit value is used when writing data to that undersized buffer. This creates a classic heap overflow condition where an attacker can write beyond allocated memory boundaries. The vulnerability is particularly critical because it requires only the "userused" delegated ZFS permission—a relatively permissive delegation that system administrators might grant to unprivileged users for storage quota monitoring—making it accessible in multi-tenant environments and containerized deployments. Local privilege escalation is the primary impact, allowing a constrained user to achieve kernel-level code execution.

While this CVE currently has no mapped MITRE ATT&CK techniques and zero matching Casky skills, Casky's Claude-powered analysis would detect the exploitation pattern through behavioral anomalies: unauthorized heap memory corruption attempts, privilege boundary violations, and kernel panic signatures that typically follow successful heap overflow exploitation. Practitioners using Casky would observe findings flagging suspicious ioctl sequences combined with memory access violations, unusual process capabilities elevation, and kernel memory protection bypass indicators. As threat intelligence matures around active exploitation, Casky's skill library would expand to map this to techniques like T1548 (Abuse Elevation Control Mechanism) and T1055 (Process Injection), enabling earlier detection of similar type-confusion vulnerabilities in other kernel subsystems.