A local unprivileged user can exploit the ZFS_IOC_SET_PROP ioctl, which is used by the zfs-set utility, to set the internal metadata flag "$hasrecvd" on any ZFS dataset. The kernel fails to validate the caller’s privileges, allowing the user to mark a dataset as if it had received properties from a zfs-recv stream. This mis‑validation grants the user the ability to alter sensitive internal metadata, bypassing normal protection mechanisms. The weakness is classified as CWE‑863: Incorrect Verification of User Permissions.

The vulnerability is present in the FreeBSD operating system. All installations that use the zfs‑set utility on affected FreeBSD releases can be impacted; versions are not explicitly listed in the advisory.

The flaw can be exploited locally by any user who can run zfs-set or otherwise access ZFSIOCTL. No CVSS score is provided in the advisory, and the EPSS score is not available. The vulnerability is not currently listed in the CISA KEV catalog, so there are no known public exploits in circulation. However, because the attack requires only local access and the kernel accepts unsigned ioctl parameters, the risk remains moderate to high in environments where users have shell access.