CVE-2026-64298

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

POSIX requires write permission to truncate a file, so an open() that

specifies O_TRUNC must be authorized for write access regardless of the

O_ACCMODE access mode.

nfs_open_permission_mask() builds the access mask passed to

nfs_may_open(), which is the local authorization gate for OPENs the

client serves itself from a cached write delegation via the

can_open_delegated() path in nfs4_try_open_cached(). The mask is

derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a

file the caller cannot write requests only MAY_READ and passes the

local check. The OPEN is then satisfied locally and the truncation is

issued to the server as a SETATTR(size=0) over the delegation stateid,

which the server accepts under standard write-delegation semantics.

POSIX requires that this open fail with EACCES.

Include MAY_WRITE in the mask whenever O_TRUNC is se

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References