Vulnerability-Lookup

FKIE_CVE-2026-64298

Vulnerability from fkie_nvd - Published: 2026-07-25 10:17 - Updated: 2026-08-17 05:17

Severity

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMODE access mode. nfs_open_permission_mask() builds the access mask passed to nfs_may_open(), which is the local authorization gate for OPENs the client serves itself from a cached write delegation via the can_open_delegated() path in nfs4_try_open_cached(). The mask is derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a file the caller cannot write requests only MAY_READ and passes the local check. The OPEN is then satisfied locally and the truncation is issued to the server as a SETATTR(size=0) over the delegation stateid, which the server accepts under standard write-delegation semantics. POSIX requires that this open fail with EACCES. Include MAY_WRITE in the mask whenever O_TRUNC is set so the local check matches the access the server would have enforced.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	7.2
linux	linux_kernel	7.2

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4817c8974315b666e895b7d1bb83cd3664c323b1",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "cb148a2762d644bff1894728e8835a9a4b84f9ea",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "30fdf4df6c3c00efec947e4ddf97f0fdd4473628",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "22c1fd1355ad4ca27aa7f0fa02719122dd92d9de",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "a937e92c1d00534b5c2e3e9f4381b7e988180797",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "e36501b7d4abdcd6d69a7cb901b2f286b7a3d041",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "5140f099ecd8a2f2808b7f7b720ee1bad8468974",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2537135-6663-4C5E-A3BC-D6A2AC03BE8B",
              "versionEndExcluding": "5.10.261",
              "versionStartIncluding": "2.6.24",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6",
              "versionEndExcluding": "5.15.212",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
              "versionEndExcluding": "6.1.178",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
              "versionEndExcluding": "6.6.145",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
              "versionEndExcluding": "6.12.96",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
              "versionEndExcluding": "6.18.39",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
              "versionEndExcluding": "7.1.4",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: include MAY_WRITE in open permission mask for O_TRUNC\n\nPOSIX requires write permission to truncate a file, so an open() that\nspecifies O_TRUNC must be authorized for write access regardless of the\nO_ACCMODE access mode.\n\nnfs_open_permission_mask() builds the access mask passed to\nnfs_may_open(), which is the local authorization gate for OPENs the\nclient serves itself from a cached write delegation via the\ncan_open_delegated() path in nfs4_try_open_cached().  The mask is\nderived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a\nfile the caller cannot write requests only MAY_READ and passes the\nlocal check.  The OPEN is then satisfied locally and the truncation is\nissued to the server as a SETATTR(size=0) over the delegation stateid,\nwhich the server accepts under standard write-delegation semantics.\nPOSIX requires that this open fail with EACCES.\n\nInclude MAY_WRITE in the mask whenever O_TRUNC is set so the local\ncheck matches the access the server would have enforced."
    }
  ],
  "id": "CVE-2026-64298",
  "lastModified": "2026-08-17T05:17:29.490",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-25T10:17:10.657",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2026-64298 (GCVE-0-2026-64298)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52

Title

NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

Summary

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/4817c8974315b666e…
https://git.kernel.org/stable/c/cb148a2762d644bff…
https://git.kernel.org/stable/c/30fdf4df6c3c00efe…
https://git.kernel.org/stable/c/22c1fd1355ad4ca27…
https://git.kernel.org/stable/c/6bd7d0a06b53c4e79…
https://git.kernel.org/stable/c/a937e92c1d00534b5…
https://git.kernel.org/stable/c/e36501b7d4abdcd6d…
https://git.kernel.org/stable/c/5140f099ecd8a2f28…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 4817c8974315b666e895b7d1bb83cd3664c323b1 (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < cb148a2762d644bff1894728e8835a9a4b84f9ea (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 30fdf4df6c3c00efec947e4ddf97f0fdd4473628 (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 22c1fd1355ad4ca27aa7f0fa02719122dd92d9de (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230 (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < a937e92c1d00534b5c2e3e9f4381b7e988180797 (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < e36501b7d4abdcd6d69a7cb901b2f286b7a3d041 (git) Affected: af22f94ae02ab9dd4fd7fe628c8434a59cc293be , < 5140f099ecd8a2f2808b7f7b720ee1bad8468974 (git)
Linux	Linux	Affected: 2.6.24 Unaffected: 0 , < 2.6.24 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4817c8974315b666e895b7d1bb83cd3664c323b1",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "cb148a2762d644bff1894728e8835a9a4b84f9ea",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "30fdf4df6c3c00efec947e4ddf97f0fdd4473628",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "22c1fd1355ad4ca27aa7f0fa02719122dd92d9de",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "a937e92c1d00534b5c2e3e9f4381b7e988180797",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "e36501b7d4abdcd6d69a7cb901b2f286b7a3d041",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            },
            {
              "lessThan": "5140f099ecd8a2f2808b7f7b720ee1bad8468974",
              "status": "affected",
              "version": "af22f94ae02ab9dd4fd7fe628c8434a59cc293be",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: include MAY_WRITE in open permission mask for O_TRUNC\n\nPOSIX requires write permission to truncate a file, so an open() that\nspecifies O_TRUNC must be authorized for write access regardless of the\nO_ACCMODE access mode.\n\nnfs_open_permission_mask() builds the access mask passed to\nnfs_may_open(), which is the local authorization gate for OPENs the\nclient serves itself from a cached write delegation via the\ncan_open_delegated() path in nfs4_try_open_cached().  The mask is\nderived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a\nfile the caller cannot write requests only MAY_READ and passes the\nlocal check.  The OPEN is then satisfied locally and the truncation is\nissued to the server as a SETATTR(size=0) over the delegation stateid,\nwhich the server accepts under standard write-delegation semantics.\nPOSIX requires that this open fail with EACCES.\n\nInclude MAY_WRITE in the mask whenever O_TRUNC is set so the local\ncheck matches the access the server would have enforced."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An unprivileged local process triggers the flaw through open/openat with O_RDONLY|O_TRUNC on an accessible NFSv4-mounted file. The resulting NFS RPC is outbound and does not make the attack remotely reachable.\nAC:L - Once the client holds a standard cached write delegation, a single deterministic open triggers the unauthorized truncation without a race or timing requirement. Delegations persist and the attacker can repeatedly target files actively written through the same client.\nPR:L - The attacker needs only ordinary local access and read/search permission for the target path; no capability or administrative privilege is required. User namespaces are unnecessary.\nUI:N - The attacker invokes open directly and no contemporaneous action by another user is required.\nS:U - The faulty client-side permission check and modification of the delegated NFS file remain within the NFS filesystem access-control authority.\nC:N - The flaw discloses no kernel or file data beyond content the caller was already authorized to read, and it involves no memory corruption.\nI:H - The attacker can irreversibly truncate the complete contents of a file for which write access was denied, causing total integrity loss of that resource.\nA:H - Truncating critical NFS-hosted executables, configuration, databases, or operational data can completely disable dependent systems or services, and the attack can be repeated against additional delegated files."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:55.989Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628"
        },
        {
          "url": "https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230"
        },
        {
          "url": "https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797"
        },
        {
          "url": "https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041"
        },
        {
          "url": "https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974"
        }
      ],
      "title": "NFSv4: include MAY_WRITE in open permission mask for O_TRUNC",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64298",
    "datePublished": "2026-07-25T08:49:35.101Z",
    "dateReserved": "2026-07-19T15:36:31.778Z",
    "dateUpdated": "2026-08-17T04:52:55.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-64298

CVE-2026-64298 (GCVE-0-2026-64298)

Tags

Sightings

Nomenclature