https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T18:55:05.642879+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/bdu:2026-11477 bdu:2026-11477 2026-09-28T18:55:05.697143+00:00 bdu:2026-11477 https://vulnerability.circl.lu/vuln/fkie_cve-2026-49431 fkie_cve-2026-49431 2026-09-28T18:55:05.697308+00:00

The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.

Any local user can set the internal ZFS metadata flag "$hasrecvd" on datasets via ZFS_IOC_SET_PROP.

 https://vulnerability.circl.lu/vuln/ghsa-hrxx-hfqm-f933 GHSA-hrxx-hfqm-f933 2026-09-28T18:55:05.697399+00:00

The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream.

Any local user can set the internal ZFS metadata flag "$hasrecvd" on datasets via ZFS_IOC_SET_PROP.