The ZFS_IOC_RECV_NEW ioctl truncates a 64‑bit payload size to a 32‑bit integer when allocating a buffer, then later uses the original 64‑bit length for a bytes‑swap operation. This mismatch can corrupt kernel memory. A local user who has been delegated the ZFS "receive" permission can trigger this flaw by sending a crafted receive stream while the filesystem is in heal mode, potentially causing the kernel to crash or allowing the user to escape to root privileges.

The vulnerability affects FreeBSD systems that include the ZFS filesystem. The advisory lists the FreeBSD kernel as the impacted product, but specific release or version information is not provided; the flaw exists in all current FreeBSD kernels that ship ZFS.

The flaw is classified as a local kernel heap overflow. Leveraging it requires the attacker to have local ZFS receive rights, so the attack vector is local. Exploitation would involve sending a malicious ZFS receive stream in heal mode so that the kernel can be corrupted and the attacker might attain higher privileges or cause a denial of service. The Advisory does not include an EPSS score or a KEV listing, and no CVSS score is supplied, but the nature of the flaw and the lack of an exploitation countermeasure imply a high degree of risk for systems that permit untrusted users to perform receive operations.