← Back

CVE-2026-49431

nvd nist
Published: Aug 19, 2026Modified: Sep 1, 2026

JSON object

Loading...
3.3
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitability: 1.8 / Impact: 1.4
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream. Any local user can set the internal ZFS metadata flag "$hasrecvd" on datasets via ZFS_IOC_SET_PROP.

Affected (38)

Products: Freebsd: Freebsd
Freebsd
1 product
Freebsd
Configuration A
38 vulnerable
Vulnerable SoftwareAffected Versions
Freebsd
Freebsd
Version 14.3
Freebsd
Version 14.3 p10
Freebsd
Version 14.3 p11
Freebsd
Version 14.3 p12
Freebsd
Version 14.3 p13
Freebsd
Version 14.3 p14
Freebsd
Version 14.3 p15
Freebsd
Version 14.3 p1
Freebsd
Version 14.3 p2
Freebsd
Version 14.3 p3
Freebsd
Version 14.3 p4
Freebsd
Version 14.3 p5
Freebsd
Version 14.3 p6
Freebsd
Version 14.3 p7
Freebsd
Version 14.3 p8
Freebsd
Version 14.3 p9
Freebsd
Version 14.4
Freebsd
Version 14.4 p1
Freebsd
Version 14.4 p2
Freebsd
Version 14.4 p3
Freebsd
Version 14.4 p4
Freebsd
Version 14.4 p5
Freebsd
Version 14.4 p6
Freebsd
Version 14.4 rc1
Freebsd
Version 15.0
Freebsd
Version 15.0 p10
Freebsd
Version 15.0 p1
Freebsd
Version 15.0 p2
Freebsd
Version 15.0 p3
Freebsd
Version 15.0 p4
Freebsd
Version 15.0 p5
Freebsd
Version 15.0 p6
Freebsd
Version 15.0 p7
Freebsd
Version 15.0 p8
Freebsd
Version 15.0 p9
Freebsd
Version 15.1
Freebsd
Version 15.1 rc2
Freebsd
Version 15.1 rc3-p1

Related CWEs

CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

Source: secteam@freebsd.org
Vendor Advisory

Timeline

No history available yet.