The ZFS_IOC_USERSPACE_MANY ioctl truncates a 64‑bit buffer size to 32 bits when allocating kernel memory, yet still uses the original 64‑bit size when writing records. This mismatch leads to a heap overflow that a local user with the ‘userused’ delegated ZFS permission can trigger, potentially allowing that user to gain higher privileges. The vulnerability is a classic buffer overflow, classified as CWE‑122. The impact is the elevation of local user privileges to kernel level, compromising system integrity and confidentiality.

FreeBSD kernels vulnerable to the ZFS_IOC_USERSPACE_MANY ioctl. No specific affected releases are listed, so all FreeBSD installations that expose this ioctl and use the ‘userused’ permission may be impacted.

The attack vector is local: an attacker must be able to execute commands on the affected system and possess the ‘userused’ ZFS permission. The exploit requires kernel interaction via the ioctl interface, making it complex for a casual attacker but straightforward for a legitimate user with delegated rights. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. However, the CVSS score of 7.8 reflects a high severity, and the ability to elevate privileges makes it a significant risk if a user can obtain the required permission.