CVE-2026-64298

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the NFSv4 implementation where the nfs open permission mask() function fails to include MAY WRITE in the access mask when the O TRUNC flag is used during a file open operation. This occurs because the mask is derived solely from O ACCMODE. Consequently, a request such as open(O RDONLY | O TRUNC) on a file where the caller lacks write permissions may pass the local authorization check in nfs may open() via the can open delegated() path in nfs4 try open cached(). This allows the truncation to be issued to the server as a SETATTR(size=0) over the delegation stateid, which the server accepts, violating POSIX requirements that such an operation should fail with EACCES.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.