CVE-2026-49431: Incorrect user validation in ZFS_IOC_SET_PROP ioctl
The ZFSIOCSETPROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.
Any local user can set the internal ZFS metadata flag "$hasrecvd" on datasets via ZFSIOCSETPROP.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any local unprivileged user can exploit it. The issue requires local access to invoke the ZFS_IOC_SET_PROP ioctl; no remote attack path is described.
What changes can an attacker make?
An attacker can set the internal "$hasrecvd" metadata flag on datasets, causing metadata to indicate that the dataset received properties from a zfs-recv(8) stream.
How can I determine whether a system may have been affected?
Review dataset metadata for the internal "$hasrecvd" flag, particularly on datasets where no corresponding zfs-recv(8) stream was expected. The provided information does not specify a detection command or remediation procedure.