CVE-2026-49431 PUBLISHED

Incorrect user validation in ZFS_IOC_SET_PROP ioctl

Assigner: freebsd
Reserved: 29.05.2026 Published: 19.08.2026 Updated: 19.08.2026

The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.

Any local user can set the internal ZFS metadata flag "$hasrecvd" on datasets via ZFS_IOC_SET_PROP.

Product Status

Vendor FreeBSD
Product FreeBSD
Versions Default: unknown
  • affected from 15.1-RELEASE to p1 (excl.)
  • affected from 15.0-RELEASE to p11 (excl.)
  • affected from 14.4-RELEASE to p7 (excl.)
  • affected from 14.3-RELEASE to p16 (excl.)

Credits

  • Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai finder
  • Emmanuel Genier at Quarkslab finder

References

Problem Types

  • CWE-863: Incorrect Authorization CWE