CVE-2026-64298 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMODE access mode.
nfs_open_permission_mask() builds the access mask passed to nfs_may_open(), which is the local authorization gate for OPENs the client serves itself from a cached write delegation via the can_open_delegated() path in nfs4_try_open_cached(). The mask is derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a file the caller cannot write requests only MAY_READ and passes the local check. The OPEN is then satisfied locally and the truncation is issued to the server as a SETATTR(size=0) over the delegation stateid, which the server accepts under standard write-delegation semantics. POSIX requires that this open fail with EACCES.
Include MAY_WRITE in the mask whenever O_TRUNC is set so the local check matches the access the server would have enforced.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability described represents a critical authorization bypass in the Linux kernel's NFSv4 implementation that undermines fundamental file system security principles. This flaw exists within the nfs_open_permission_mask() function which constructs the access permission mask used for local authorization checks before forwarding OPEN operations to the NFS server. The issue stems from the incorrect handling of the O_TRUNC flag during file open operations, where the system fails to properly enforce POSIX compliance requirements for write permissions when truncation is requested. When a process attempts to open a file with O_RDONLY | O_TRUNC flags, the current implementation only considers the read-only access mode in determining the permission mask, completely ignoring the write implications of the truncation operation.
The technical execution of this vulnerability occurs through the nfs4_try_open_cached() function path which handles cached write delegations. The nfs_open_permission_mask() function derives its access mask exclusively from O_ACCMODE bits without incorporating the O_TRUNC flag's implications, creating a mismatch between local authorization and server-side enforcement. This design flaw allows a client to locally satisfy an OPEN request for a file they cannot write to, even when O_TRUNC is specified, by leveraging write delegation semantics where the server accepts SETATTR operations with size=0 on delegated stateids. The underlying problem demonstrates a classic case of insufficient input validation and authorization checking that violates the principle of least privilege.
The operational impact of this vulnerability extends beyond simple permission bypass to potentially enable unauthorized file modification through truncation operations. An attacker could exploit this weakness to truncate files they normally lack write permissions for, effectively compromising file integrity and potentially enabling data destruction or corruption attacks. The vulnerability affects systems running Linux kernels with NFSv4 support where cached write delegations are actively used, making it particularly concerning in enterprise environments where NFS is commonly deployed for shared storage solutions. This issue directly violates POSIX standards that mandate write permission requirements for truncation operations, creating a security gap that could be leveraged for privilege escalation or data manipulation attacks.
The fix implemented addresses this vulnerability by modifying the nfs_open_permission_mask() function to include MAY_WRITE in the access permission mask whenever the O_TRUNC flag is set. This change ensures that local authorization checks properly account for the write implications of truncation operations, making the client-side validation consistent with server-side enforcement mechanisms. The solution aligns with established security principles and follows the ATT&CK framework's guidance on privilege escalation and credential access by ensuring proper access control validation. This modification resolves the mismatch between client-side and server-side authorization checks while maintaining backward compatibility for legitimate use cases. The fix specifically targets CWE-284, which addresses improper access control in software systems, and provides a robust solution that enforces the correct security semantics for file operations under NFSv4 implementations.
The corrected implementation ensures that any attempt to open a file with O_TRUNC flag requires proper write permissions regardless of the access mode specified, thereby maintaining POSIX compliance and preventing unauthorized truncation operations. This enhancement strengthens the overall security posture of Linux systems using NFSv4 by ensuring that local authorization checks accurately reflect the actual security requirements imposed by the underlying file system semantics. The vulnerability resolution demonstrates the importance of comprehensive permission checking in distributed file systems where client-side caching and delegation mechanisms can introduce subtle but critical security gaps if not properly synchronized with server-side enforcement policies.