{"id":"CVE-2026-64298","summary":"NFSv4: include MAY_WRITE in open permission mask for O_TRUNC","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: include MAY_WRITE in open permission mask for O_TRUNC\n\nPOSIX requires write permission to truncate a file, so an open() that\nspecifies O_TRUNC must be authorized for write access regardless of the\nO_ACCMODE access mode.\n\nnfs_open_permission_mask() builds the access mask passed to\nnfs_may_open(), which is the local authorization gate for OPENs the\nclient serves itself from a cached write delegation via the\ncan_open_delegated() path in nfs4_try_open_cached().  The mask is\nderived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a\nfile the caller cannot write requests only MAY_READ and passes the\nlocal check.  The OPEN is then satisfied locally and the truncation is\nissued to the server as a SETATTR(size=0) over the delegation stateid,\nwhich the server accepts under standard write-delegation semantics.\nPOSIX requires that this open fail with EACCES.\n\nInclude MAY_WRITE in the mask whenever O_TRUNC is set so the local\ncheck matches the access the server would have enforced.","modified":"2026-07-28T04:03:03.632094983Z","published":"2026-07-25T08:49:35.101Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64298.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de"},{"type":"WEB","url":"https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64298.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64298"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"af22f94ae02ab9dd4fd7fe628c8434a59cc293be"},{"fixed":"4817c8974315b666e895b7d1bb83cd3664c323b1"},{"fixed":"cb148a2762d644bff1894728e8835a9a4b84f9ea"},{"fixed":"30fdf4df6c3c00efec947e4ddf97f0fdd4473628"},{"fixed":"22c1fd1355ad4ca27aa7f0fa02719122dd92d9de"},{"fixed":"6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230"},{"fixed":"a937e92c1d00534b5c2e3e9f4381b7e988180797"},{"fixed":"e36501b7d4abdcd6d69a7cb901b2f286b7a3d041"},{"fixed":"5140f099ecd8a2f2808b7f7b720ee1bad8468974"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64298.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.24"},{"fixed":"5.10.261"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.96"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.39"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64298.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}]}