Detections
Analytics
FreeBSD : FreeBSD -- Multiple vulnerabilities in OpenZFS (9534b664-74e1-11f1-958d-bc241121aa0a)
high Nessus Plugin ID 324128
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9534b664-74e1-11f1-958d-bc241121aa0a advisory.The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records.
The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation.
The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.
A local user with the userused delegated ZFS permission can trigger a kernel heap overflow via the ZFS_IOC_USERSPACE_MANY ioctl, potentially escalating privileges. [CVE-2026-49429] A local user with the receive delegated ZFS permission can trigger kernel memory corruption via ZFS_IOC_RECV_NEW by sending a crafted receive stream in heal mode. [CVE-2026-49430] Any local user can set the internal ZFS metadata flag $hasrecvd on datasets via ZFS_IOC_SET_PROP. [CVE-2026-49431]
Tenable has extracted the preceding description block directly from the FreeBSD security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
Plugin Details
Severity: High
ID: 324128
File Name: freebsd_pkg_9534b66474e111f1958dbc241121aa0a.nasl
Version: 1.1
Type: Local
Family: FreeBSD Local Security Checks
Published: 7/1/2026
Updated: 7/1/2026
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:freebsd-kernel, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Settings/ParanoidReport, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Exploit Ease: No known exploits are available
Patch Publication Date: 7/1/2026
Vulnerability Publication Date: 7/1/2026