FreeBSD ZFS: unprivileged local user can set the internal $hasrecvd metadata flag on a dataset

Impact

ZFS_IOC_SET_PROP validates the calling user incorrectly, letting any local user mark a dataset with the internal $hasrecvd flag that normally indicates properties arrived from a zfs-recv stream. The advisory claims nothing beyond setting that flag - no memory corruption, no privilege gain, no data access. Practical effect on a storage node is limited to confusing property inheritance and replication tooling that keys off received-property state. Worth patching in the same window as the more serious ZFS issue in the same advisory rather than on its own.

Who can reach it

Any local user on the FreeBSD host; no delegated ZFS permission and no remote access required.

What to do

Covered by the same FreeBSD-SA-26:40.zfs fix as CVE-2026-49430 - patch the kernel and reboot the host. There is no separate mitigation, and on its own this issue does not justify its own maintenance window.

References