A local unprivileged user can exploit the ZFS_IOC_SET_PROP ioctl, used by the zfs-set utility, to set the internal metadata flag "$hasrecvd" on any ZFS dataset. The kernel fails to validate the caller’s privileges, allowing the user to mark a dataset as if it had received properties from a zfs-recv stream. This mis‑validation grants the user the ability to alter sensitive internal metadata, bypassing normal protection mechanisms. The weakness is classified as CWE‑863: Incorrect Verification of User Permissions.

The vulnerability is present in the FreeBSD operating system. All installations that use the zfs‑set utility on affected FreeBSD releases can be impacted; versions are not explicitly listed in the advisory.

The vulnerability can be exploited locally by any user who can run the zfs‑set command or otherwise access the ZFS_IOC_SET_PROP ioctl. The CVSS score of 3.3 indicates a low severity vulnerability; the EPSS score is below 1%, suggesting a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog, so no publicly known exploits exist. Nevertheless, any local user can modify sensitive internal metadata by setting the “$hasrecvd” flag, which could affect dataset integrity and subsequent operations.