CVE-2026-64298 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
An attacker with read-only access can truncate files via NFSv4 due to missing write permission checks during O_TRUNC operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64298?
CVE-2026-64298 is a high-severity missing authorization vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMODE access mode.
nfs_open_permission_mask() builds the access mask passed to nfs_may_open(), which is the local authorization gate for OPENs the client serves itself from a cached write delegation via the can_open_delegated() path in nfs4_try_open_cached(). The mask is derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a file the caller cannot write requests only MAY_READ and passes the local check. The OPEN is then satisfied locally and the truncation is issued to the server as a SETATTR(size=0) over the delegation stateid, which the server accepts under standard write-delegation semantics. POSIX requires that this open fail with EACCES.
Include MAY_WRITE in the mask whenever O_TRUNC is set so the local check matches the access the server would have enforced.
Weakness: CWE-862
Which versions are affected by CVE-2026-64298?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64298?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-64298 being exploited?
There is no known exploitation of CVE-2026-64298 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-93668, BELL-CVE-2026-64298, DEBIAN-CVE-2026-64298, GHSA-mj8v-3x8m-9rx7, ROOT-OS-DEBIAN-12-CVE-2026-64298, ROOT-OS-UBUNTU-2204-CVE-2026-64298 and 1 more.