ZFS Local Privilege Escalation via setprop ioctl
CVE-2026-49431 Published on August 19, 2026
Incorrect user validation in ZFS_IOC_SET_PROP ioctl
The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.
Any local user can set the internal ZFS metadata flag "$hasrecvd" on datasets via ZFS_IOC_SET_PROP.
Vulnerability Analysis
CVE-2026-49431 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-49431 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-49431
Want to know whenever a new CVE is published for FreeBSD? stack.watch will email you.
Affected Versions
FreeBSD:- Version 15.1-RELEASE and below p1 is affected.
- Version 15.0-RELEASE and below p11 is affected.
- Version 14.4-RELEASE and below p7 is affected.
- Version 14.3-RELEASE and below p16 is affected.