Executive brief
A vulnerability was identified in the Linux kernel's NFSv4 implementation where file truncation permissions were not correctly enforced. This could allow a local user to truncate (clear the contents of) a file they only have read access to, potentially leading to data loss or service disruption. The issue occurs when the system incorrectly validates access rights for files served from a local cache.
Technical details
A vulnerability exists in the NFSv4 client within the Linux kernel where nfs_open_permission_mask() fails to include MAY_WRITE when the O_TRUNC flag is set. This allows an open(O_RDONLY | O_TRUNC) request to pass local authorization checks in nfs4_try_open_cached() even if the user lacks write permissions. Consequently, the client may locally satisfy the open request and issue a SETATTR(size=0) to the server using a cached write delegation stateid, resulting in unauthorized file truncation. This behavior violates POSIX requirements and has been resolved by ensuring MAY_WRITE is included in the permission mask whenever O_TRUNC is specified.
Affected products
- Linux Linux af22f94ae02ab9dd4fd7fe628c8434a59cc293be to 5140f099ecd8a2f2808b7f7b720ee1bad8468974
Timeline
- 2026-07-25: advisory: CVE-2026-64298 published
- 2026-07-24: patched: Fixes committed to various stable kernel branches
References
- https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de
- https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628
- https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1
- https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974
- https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230
- https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797
- https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea