GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64298 (GCVE-0-2026-64298)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
Title
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMODE access mode. nfs_open_permission_mask() builds the access mask passed to nfs_may_open(), which is the local authorization gate for OPENs the client serves itself from a cached write delegation via the can_open_delegated() path in nfs4_try_open_cached(). The mask is derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a file the caller cannot write requests only MAY_READ and passes the local check. The OPEN is then satisfied locally and the truncation is issued to the server as a SETATTR(size=0) over the delegation stateid, which the server accepts under standard write-delegation semantics. POSIX requires that this open fail with EACCES. Include MAY_WRITE in the mask whenever O_TRUNC is set so the local check matches the access the server would have enforced.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 4817c8974315b666e895b7d1bb83cd3664c323b1 (git)
Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < cb148a2762d644bff1894728e8835a9a4b84f9ea (git)
Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 30fdf4df6c3c00efec947e4ddf97f0fdd4473628 (git)
Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 22c1fd1355ad4ca27aa7f0fa02719122dd92d9de (git)
Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230 (git)
Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < a937e92c1d00534b5c2e3e9f4381b7e988180797 (git)
Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < e36501b7d4abdcd6d69a7cb901b2f286b7a3d041 (git)
Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 5140f099ecd8a2f2808b7f7b720ee1bad8468974 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.24
Unaffected: 0 , < 2.6.24 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4817c8974315b666e895b7d1bb83cd3664c323b1",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "cb148a2762d644bff1894728e8835a9a4b84f9ea",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "30fdf4df6c3c00efec947e4ddf97f0fdd4473628",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "22c1fd1355ad4ca27aa7f0fa02719122dd92d9de",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "a937e92c1d00534b5c2e3e9f4381b7e988180797",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "e36501b7d4abdcd6d69a7cb901b2f286b7a3d041",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "5140f099ecd8a2f2808b7f7b720ee1bad8468974",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: include MAY_WRITE in open permission mask for O_TRUNC\n\nPOSIX requires write permission to truncate a file, so an open() that\nspecifies O_TRUNC must be authorized for write access regardless of the\nO_ACCMODE access mode.\n\nnfs_open_permission_mask() builds the access mask passed to\nnfs_may_open(), which is the local authorization gate for OPENs the\nclient serves itself from a cached write delegation via the\ncan_open_delegated() path in nfs4_try_open_cached().  The mask is\nderived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a\nfile the caller cannot write requests only MAY_READ and passes the\nlocal check.  The OPEN is then satisfied locally and the truncation is\nissued to the server as a SETATTR(size=0) over the delegation stateid,\nwhich the server accepts under standard write-delegation semantics.\nPOSIX requires that this open fail with EACCES.\n\nInclude MAY_WRITE in the mask whenever O_TRUNC is set so the local\ncheck matches the access the server would have enforced."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An unprivileged local process triggers the flaw through open/openat with O_RDONLY|O_TRUNC on an accessible NFSv4-mounted file. The resulting NFS RPC is outbound and does not make the attack remotely reachable.\nAC:L - Once the client holds a standard cached write delegation, a single deterministic open triggers the unauthorized truncation without a race or timing requirement. Delegations persist and the attacker can repeatedly target files actively written through the same client.\nPR:L - The attacker needs only ordinary local access and read/search permission for the target path; no capability or administrative privilege is required. User namespaces are unnecessary.\nUI:N - The attacker invokes open directly and no contemporaneous action by another user is required.\nS:U - The faulty client-side permission check and modification of the delegated NFS file remain within the NFS filesystem access-control authority.\nC:N - The flaw discloses no kernel or file data beyond content the caller was already authorized to read, and it involves no memory corruption.\nI:H - The attacker can irreversibly truncate the complete contents of a file for which write access was denied, causing total integrity loss of that resource.\nA:H - Truncating critical NFS-hosted executables, configuration, databases, or operational data can completely disable dependent systems or services, and the attack can be repeated against additional delegated files."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:55.989Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628"
        },
        {
          "url": "https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230"
        },
        {
          "url": "https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797"
        },
        {
          "url": "https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041"
        },
        {
          "url": "https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974"
        }
      ],
      "title": "NFSv4: include MAY_WRITE in open permission mask for O_TRUNC",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64298",
    "datePublished": "2026-07-25T08:49:35.101Z",
    "dateReserved": "2026-07-19T15:36:31.778Z",
    "dateUpdated": "2026-08-17T04:52:55.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64298",
      "date": "2026-09-16",
      "epss": "0.00164",
      "percentile": "0.06041"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:45:03.000Z",
      "cve": "CVE-2026-64298",
      "id": "msrc_CVE-2026-64298",
      "initial_release_date": "2026-07-26T01:02:41.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "NFSv4: include MAY_WRITE in open permission mask for O_TRUNC",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64298.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64298\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:10.657\",\"lastModified\":\"2026-08-17T05:17:29.490\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFSv4: include MAY_WRITE in open permission mask for O_TRUNC\\n\\nPOSIX requires write permission to truncate a file, so an open() that\\nspecifies O_TRUNC must be authorized for write access regardless of the\\nO_ACCMODE access mode.\\n\\nnfs_open_permission_mask() builds the access mask passed to\\nnfs_may_open(), which is the local authorization gate for OPENs the\\nclient serves itself from a cached write delegation via the\\ncan_open_delegated() path in nfs4_try_open_cached().  The mask is\\nderived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a\\nfile the caller cannot write requests only MAY_READ and passes the\\nlocal check.  The OPEN is then satisfied locally and the truncation is\\nissued to the server as a SETATTR(size=0) over the delegation stateid,\\nwhich the server accepts under standard write-delegation semantics.\\nPOSIX requires that this open fail with EACCES.\\n\\nInclude MAY_WRITE in the mask whenever O_TRUNC is set so the local\\ncheck matches the access the server would have enforced.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfs/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\"lessThan\":\"4817c8974315b666e895b7d1bb83cd3664c323b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\"lessThan\":\"cb148a2762d644bff1894728e8835a9a4b84f9ea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\"lessThan\":\"30fdf4df6c3c00efec947e4ddf97f0fdd4473628\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\"lessThan\":\"22c1fd1355ad4ca27aa7f0fa02719122dd92d9de\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\"lessThan\":\"6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\"lessThan\":\"a937e92c1d00534b5c2e3e9f4381b7e988180797\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\"lessThan\":\"e36501b7d4abdcd6d69a7cb901b2f286b7a3d041\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\"lessThan\":\"5140f099ecd8a2f2808b7f7b720ee1bad8468974\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfs/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.24\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.24\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.24\",\"versionEndExcluding\":\"5.10.261\",\"matchCriteriaId\":\"E2537135-6663-4C5E-A3BC-D6A2AC03BE8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.212\",\"matchCriteriaId\":\"8E99FB01-CD93-41AF-A653-3F450652B9A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.178\",\"matchCriteriaId\":\"092233C7-F4E0-40C8-BD4D-A28FE50DFE20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.145\",\"matchCriteriaId\":\"7046B092-F810-4440-ACE6-60218518EECE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.96\",\"matchCriteriaId\":\"38A8100E-2B1A-462F-AEE9-8901B870FEF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.39\",\"matchCriteriaId\":\"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.1.4\",\"matchCriteriaId\":\"6228DDD6-4557-4AA3-9F43-AB995D471E42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E8B9085-7ADB-4A05-89EF-12949B6A0509\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-04T08:03:58+00:00",
      "cve": "CVE-2026-64298",
      "id": "CVE-2026-64298",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:fixed": "762",
      "product_status:known_affected": "64",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64298.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:08:38Z",
      "cve": "CVE-2026-64298",
      "id": "CVE-2026-64298",
      "initial_release_date": "2026-07-25T16:46:17Z",
      "product_status:known_affected": "667",
      "product_status:recommended": "235",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64298",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64298.json",
      "version": "15"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.