ZFS Local Privilege Escalation via setprop ioctl
CVE-2026-49431 Published on August 19, 2026
Incorrect user validation in ZFS_IOC_SET_PROP ioctl
The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.
Any local user can set the internal ZFS metadata flag "$hasrecvd" on datasets via ZFS_IOC_SET_PROP.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-49431 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-49431
Want to know whenever a new CVE is published for FreeBSD? stack.watch will email you.
Affected Versions
FreeBSD:- Version 15.1-RELEASE and below p1 is affected.
- Version 15.0-RELEASE and below p11 is affected.
- Version 14.4-RELEASE and below p7 is affected.
- Version 14.3-RELEASE and below p16 is affected.