Skip to content
CVE PROGRAM SOURCE RECORD3.3 Low

CVE-2026-49431

Incorrect user validation in ZFS_IOC_SET_PROP ioctl

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream. Any local user can set the internal ZFS metadata flag "$hasrecvd" on datasets via ZFS_IOC_SET_PROP.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unknown

  • 15.1-RELEASE to < p1affected
  • 15.0-RELEASE to < p11affected
  • 14.4-RELEASE to < p7affected
  • 14.3-RELEASE to < p16affected

References