{"id":"CVE-2026-49431","aliases":["EUVD-2026-62241","GHSA-hrxx-hfqm-f933"],"status":"published","title":"Incorrect user validation in ZFS_IOC_SET_PROP ioctl","description":"The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.\n\nAny local user can set the internal ZFS metadata flag \"$hasrecvd\" on datasets via ZFS_IOC_SET_PROP.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00121,"percentile":0.01934,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-08-19T05:15:37Z","modified":"2026-11-09T20:10:00Z","products":[{"vendor":"freebsd","product":"freebsd"}],"references":[{"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:40.zfs.asc","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49431"},{"url":"https://github.com/advisories/GHSA-hrxx-hfqm-f933"}],"sources":{"cve":[{"id":"CVE-2026-49431","title":"Incorrect user validation in ZFS_IOC_SET_PROP ioctl","description":"The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.\n\nAny local user can set the internal ZFS metadata flag \"$hasrecvd\" on datasets via ZFS_IOC_SET_PROP.","status":"published","published":"2026-08-19T05:15:37.371Z","modified":"2026-08-26T17:42:19.637Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-62241","description":"The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.\n\nAny local user can set the internal ZFS metadata flag \"$hasrecvd\" on datasets via ZFS_IOC_SET_PROP.","status":"published","published":"2026-08-19T05:15:37Z","modified":"2026-08-26T17:42:19Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:01:30.08255Z"}],"ghsa":[{"id":"GHSA-hrxx-hfqm-f933","title":"The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that...","description":"The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.\n\nAny local user can set the internal ZFS metadata flag \"$hasrecvd\" on datasets via ZFS_IOC_SET_PROP.","status":"published","published":"2026-08-19T06:31:18Z","modified":"2026-08-26T18:31:14Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:10:59.276943Z"}],"nvd":[{"id":"CVE-2026-49431","description":"The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.\n\nAny local user can set the internal ZFS metadata flag \"$hasrecvd\" on datasets via ZFS_IOC_SET_PROP.","status":"published","published":"2026-08-19T06:17:43.027Z","modified":"2026-11-09T20:10:00.2Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-09T22:15:51.558963Z"}]}}