The ZFS_IOC_RECV_NEW ioctl truncates a 64‑bit payload size to a 32‑bit integer when allocating a buffer, then later uses the original 64‑bit length for a bytes‑swap operation. This mismatch can corrupt kernel memory. A local user who has been delegated the ZFS "receive" permission can trigger this flaw by sending a crafted receive stream while the filesystem is in heal mode, potentially causing the kernel to crash or allowing the user to escape to root privileges.

The vulnerability affects FreeBSD systems that include the ZFS filesystem. The advisory lists the FreeBSD kernel as the impacted product, but specific release or version information is not provided; the flaw exists in all current FreeBSD kernels that ship ZFS.

The flaw is classified as a local kernel heap overflow. Leveraging it requires the attacker to have local ZFS receive rights, so the attack vector is local. Exploitation would involve sending a malicious ZFS receive stream in heal mode so that the kernel can be corrupted and the attacker might attain higher privileges or cause a denial of service. The advisory lists a CVSS score of 7.8 and an EPSS score of <1%, and the vulnerability is not listed in CISA KEV. The high CVSS score indicates a significant risk, while the low EPSS score suggests limited exploitation probability at this time.