3.3

CVE-2026-49431

Incorrect user validation in ZFS_IOC_SET_PROP ioctl

The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.

Any local user can set the internal ZFS metadata flag "$hasrecvd" on datasets via ZFS_IOC_SET_PROP.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Freebsd ≫ Freebsd Version 14.3 Update -
Freebsd ≫ Freebsd Version 14.3 Update p1
Freebsd ≫ Freebsd Version 14.3 Update p10
Freebsd ≫ Freebsd Version 14.3 Update p11
Freebsd ≫ Freebsd Version 14.3 Update p12
Freebsd ≫ Freebsd Version 14.3 Update p13
Freebsd ≫ Freebsd Version 14.3 Update p14
Freebsd ≫ Freebsd Version 14.3 Update p15
Freebsd ≫ Freebsd Version 14.3 Update p2
Freebsd ≫ Freebsd Version 14.3 Update p3
Freebsd ≫ Freebsd Version 14.3 Update p4
Freebsd ≫ Freebsd Version 14.3 Update p5
Freebsd ≫ Freebsd Version 14.3 Update p6
Freebsd ≫ Freebsd Version 14.3 Update p7
Freebsd ≫ Freebsd Version 14.3 Update p8
Freebsd ≫ Freebsd Version 14.3 Update p9
Freebsd ≫ Freebsd Version 14.4 Update -
Freebsd ≫ Freebsd Version 14.4 Update p1
Freebsd ≫ Freebsd Version 14.4 Update p2
Freebsd ≫ Freebsd Version 14.4 Update p3
Freebsd ≫ Freebsd Version 14.4 Update p4
Freebsd ≫ Freebsd Version 14.4 Update p5
Freebsd ≫ Freebsd Version 14.4 Update p6
Freebsd ≫ Freebsd Version 14.4 Update rc1
Freebsd ≫ Freebsd Version 15.0 Update -
Freebsd ≫ Freebsd Version 15.0 Update p1
Freebsd ≫ Freebsd Version 15.0 Update p10
Freebsd ≫ Freebsd Version 15.0 Update p2
Freebsd ≫ Freebsd Version 15.0 Update p3
Freebsd ≫ Freebsd Version 15.0 Update p4
Freebsd ≫ Freebsd Version 15.0 Update p5
Freebsd ≫ Freebsd Version 15.0 Update p6
Freebsd ≫ Freebsd Version 15.0 Update p7
Freebsd ≫ Freebsd Version 15.0 Update p8
Freebsd ≫ Freebsd Version 15.0 Update p9
Freebsd ≫ Freebsd Version 15.1 Update -
Freebsd ≫ Freebsd Version 15.1 Update rc2
Freebsd ≫ Freebsd Version 15.1 Update rc3-p1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.076
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 3.3 1.8 1.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://security.freebsd.org/advisories/FreeBSD-SA-26:40.zfs.asc
Vendor Advisory