{"id":"CVE-2026-64298","revision":"bb449888bd424ae4ac01a47d3c4a107c","records":[{"revision":"bb449888bd424ae4ac01a47d3c4a107c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64298","aliases":[],"title":"NFSv4: include MAY_WRITE in open permission mask for O_TRUNC","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: include MAY_WRITE in open permission mask for O_TRUNC\n\nPOSIX requires write permission to truncate a file, so an open() that\nspecifies O_TRUNC must be authorized for write access regardless of the\nO_ACCMODE access mode.\n\nnfs_open_permission_mask() builds the access mask passed to\nnfs_may_open(), which is the local authorization gate for OPENs the\nclient serves itself from a cached write delegation via the\ncan_open_delegated() path in nfs4_try_open_cached().  The mask is\nderived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a\nfile the caller cannot write requests only MAY_READ and passes the\nlocal check.  The OPEN is then satisfied locally and the truncation is\nissued to the server as a SETATTR(size=0) over the delegation stateid,\nwhich the server accepts under standard write-delegation semantics.\nPOSIX requires that this open fail with EACCES.\n\nInclude MAY_WRITE in the mask whenever O_TRUNC is set so the local\ncheck matches the access the server would have enforced.","state":0,"publishedAt":"2026-07-25T08:49:35.101+00:00","modifiedAt":"2026-10-19T20:38:22.558+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfs/dir.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\n                            \"lessThan\": \"4817c8974315b666e895b7d1bb83cd3664c323b1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\n                            \"lessThan\": \"cb148a2762d644bff1894728e8835a9a4b84f9ea\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\n                            \"lessThan\": \"30fdf4df6c3c00efec947e4ddf97f0fdd4473628\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\n                            \"lessThan\": \"22c1fd1355ad4ca27aa7f0fa02719122dd92d9de\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\n                            \"lessThan\": \"6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\n                            \"lessThan\": \"a937e92c1d00534b5c2e3e9f4381b7e988180797\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\n                            \"lessThan\": \"e36501b7d4abdcd6d69a7cb901b2f286b7a3d041\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"af22f94ae02ab9dd4fd7fe628c8434a59cc293be\",\n                            \"lessThan\": \"5140f099ecd8a2f2808b7f7b720ee1bad8468974\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nfs/dir.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.24\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.24\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.261\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.96\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.39\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.4\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":7.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1","https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea","https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628","https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de","https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230","https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797","https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041","https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64298","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64298","identifiers":["CVE-2026-64298"]},"retained":false,"historicalAffected":[]}],"coverage":[]}