FreeBSD ZFS: unprivileged local user can set the internal $hasrecvd metadata flag on a dataset

Impact

ZFS_IOC_SET_PROP validates the calling user incorrectly, letting any local user mark a dataset with the internal $hasrecvd flag that normally indicates properties arrived from a zfs-recv stream. The advisory claims nothing beyond setting that flag - no memory corruption, no privilege gain, no data access. Practical effect on a storage node is limited to confusing property inheritance and replication tooling that keys off received-property state. Worth patching in the same window as the more serious ZFS issue in the same advisory rather than on its own.

Who can reach it

Any local user on the FreeBSD host; no delegated ZFS permission and no remote access required.

What to do

Covered by the same FreeBSD-SA-26:40.zfs fix as CVE-2026-49430 - patch the kernel and reboot the host. There is no separate mitigation, and on its own this issue does not justify its own maintenance window.

References

Related entries

• OpenSSL QUIC: peer controls how long packet buffers stay pinned, inflating memory per streamCVE-2026-54873 · OpenSSL QUIC stack (zero-copy packet buffer retention per stream)Unscored
• Xen (grant tables): Type confusion in grant-copy - guest corrupts hypervisor stateCVE-2026-62428 · Xen (grant tables)Unscored
• Xen (grant tables): Grant-table version change racing with other operationsCVE-2026-62435 · Xen (grant tables)Unscored
• OpenSSL: attacker-controlled CMP sender DN reaches ERR_raise_data() as a format string, crashing the clientCVE-2026-63073 · OpenSSL CMP client (ossl_cmp_msg_check_update sender DN handling)Unscored
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeCVE-2026-63882 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Unscored
• Linux kernel x86: no IBPB flush on BPF JIT memory reuse while Spectre-v2 mitigations are in useCVE-2026-64507 · Linux kernel x86/bugs (IBPB flush on BPF JIT allocation)Unscored