Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-64298

NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMODE access mode. nfs_open_permission_mask() builds the access mask passed to nfs_may_open(), which is the local authorization gate for OPENs the client serves itself from a cached write delegation via the can_open_delegated() path in nfs4_try_open_cached(). The mask is derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a file the caller cannot write requests only MAY_READ and passes the local check. The OPEN is then satisfied locally and the truncation is issued to the server as a SETATTR(size=0) over the delegation stateid, which the server accepts under standard write-delegation semantics. POSIX requires that this open fail with EACCES. Include MAY_WRITE in the mask whenever O_TRUNC is set so the local check matches the access the server would have enforced.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From af22f94ae02ab9dd4fd7fe628c8434a59cc293be · fixed in 4817c8974315b666e895b7d1bb83cd3664c323b1; From af22f94ae02ab9dd4fd7fe628c8434a59cc293be · fixed in cb148a2762d644bff1894728e8835a9a4b84f9ea; From af22f94ae02ab9dd4fd7fe628c8434a59cc293be · fixed in 30fdf4df6c3c00efec947e4ddf97f0fdd4473628; From af22f94ae02ab9dd4fd7fe628c8434a59cc293be · fixed in 22c1fd1355ad4ca27aa7f0fa02719122dd92d9de; From af22f94ae02ab9dd4fd7fe628c8434a59cc293be · fixed in 6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230; From af22f94ae02ab9dd4fd7fe628c8434a59cc293be · fixed in a937e92c1d00534b5c2e3e9f4381b7e988180797; From af22f94ae02ab9dd4fd7fe628c8434a59cc293be · fixed in e36501b7d4abdcd6d69a7cb901b2f286b7a3d041; From af22f94ae02ab9dd4fd7fe628c8434a59cc293be · fixed in 5140f099ecd8a2f2808b7f7b720ee1bad8468974

  • Linux Linux

    2.6.24

  • KernelLinux

    From 2.6.24 · fixed in 5.10.261; From 5.11.0 · fixed in 5.15.212; From 5.16.0 · fixed in 6.1.178; From 6.2.0 · fixed in 6.6.145; From 6.7.0 · fixed in 6.12.96; From 6.13.0 · fixed in 6.18.39; From 6.19.0 · fixed in 7.1.4

References 8

git.kernel.org