CVE-2026-49431: ZFS Privilege Escalation Vulnerability

CVE-2026-49431 Overview

CVE-2026-49431 is an improper authorization vulnerability [CWE-863] in the OpenZFS implementation shipped with FreeBSD. The ZFS_IOC_SET_PROP ioctl, invoked by zfs-set(8), fails to correctly validate the calling user. As a result, any local unprivileged user can set the internal ZFS metadata flag $hasrecvd on datasets. This flag normally indicates that a dataset received properties from a zfs-recv(8) stream. The flaw was disclosed in the FreeBSD Security Advisory FreeBSD-SA-26:40.zfs.

Critical Impact
Local users can manipulate internal ZFS dataset metadata without privileges, altering property inheritance and replication semantics on affected systems.

Affected Products

FreeBSD (OpenZFS component, zfs-set(8) and ZFS_IOC_SET_PROP ioctl)
Systems using the affected OpenZFS ZFS_IOC_SET_PROP code path
Refer to FreeBSD-SA-26:40.zfs for specific affected releases

Discovery Timeline

2026-08-19 - CVE-2026-49431 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-49431

Vulnerability Analysis

The issue resides in the authorization logic guarding the ZFS_IOC_SET_PROP ioctl. This ioctl backs the zfs set command and is expected to restrict property modifications to callers with adequate privileges. The vulnerable code path does not correctly identify the caller's privilege level when the requested operation touches the internal $hasrecvd metadata flag. Local unprivileged users can therefore issue the ioctl and toggle this flag on datasets they should not be able to modify. The Exploit Prediction Scoring System indicates low near-term exploitation probability, and no public proof-of-concept has been observed.

Root Cause

The root cause is an authorization check flaw [CWE-863] in the ZFS ioctl handler. The handler validates the calling user against permissions for user-visible properties but does not enforce the same restriction on the internal $hasrecvd metadata flag. This creates a gap where a metadata-only path bypasses the intended privilege model.

Attack Vector

Exploitation requires local access with an unprivileged user account. The attacker invokes zfs set or issues the ZFS_IOC_SET_PROP ioctl directly against a target dataset. Setting $hasrecvd alters ZFS's internal accounting of whether a dataset has received properties via zfs recv. This affects property inheritance behavior and can interfere with backup, replication, and administrative workflows that rely on this flag. The vulnerability does not itself grant code execution or read access to protected data. See the FreeBSD Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-49431

Indicators of Compromise

Unexpected presence or state changes of the $hasrecvd flag on datasets that have not been targets of zfs recv operations.
Audit records showing ZFS_IOC_SET_PROP ioctl invocations from unprivileged user IDs.
Discrepancies between replication logs and dataset receive-state metadata.

Detection Strategies

Enable and review kernel or auditd-style logging for ZFS ioctl calls, filtering on ZFS_IOC_SET_PROP invocations by non-root UIDs.
Periodically snapshot dataset metadata and diff $hasrecvd values against a known-good baseline to surface unauthorized changes.
Correlate zfs command execution in shell history and process accounting with dataset property drift.

Monitoring Recommendations

Forward FreeBSD audit logs to a central SIEM and alert on ZFS_IOC_SET_PROP events originating from unprivileged accounts.
Track zfs get -H -o value $hasrecvd output across production datasets on a scheduled basis and alert on changes.
Monitor replication job outcomes for anomalies that may indicate tampered receive-state metadata.

How to Mitigate CVE-2026-49431

Immediate Actions Required

Apply the FreeBSD errata patch referenced in FreeBSD-SA-26:40.zfs on all affected hosts.
Restrict shell access on ZFS-hosting systems to trusted administrative users until patching completes.
Baseline the $hasrecvd flag on production datasets before and after patching to identify prior tampering.

Patch Information

FreeBSD has released updates addressing this vulnerability. Consult the FreeBSD Security Advisory FreeBSD-SA-26:40.zfs for affected versions, patch commit references, and upgrade instructions. Apply the vendor patch through freebsd-update or rebuild from source per the advisory.

Workarounds

Limit local login access to trusted administrators on systems running vulnerable OpenZFS builds.
Audit and reduce use of shared multi-user hosts that mount sensitive ZFS datasets.
Verify integrity of dataset receive-state metadata after any suspected unauthorized activity and reset $hasrecvd where appropriate using privileged tooling.