CVE-2026-64298 (CVSS 7.1)

Description

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMODE access mode. nfs_open_permission_mask() builds the access mask passed to nfs_may_open(), which is the local authorization gate for OPENs the client serves itself from a cached write delegation via the can_open_delegated() path in nfs4_try_open_cached(). The mask is derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a file the caller cannot write requests only MAY_READ and passes the local check. The OPEN is then satisfied locally and the truncation is issued to the server as a SETATTR(size=0) over the delegation stateid, which the server accepts under standard write-delegation semantics. POSIX requires that this open fail with EACCES. Include MAY_WRITE in the mask whenever O_TRUNC is set so the local check matches the access the server would have enforced.

Is your site exposed to CVE-2026-64298?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.1

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS — Exploit Prediction

0.0016

Probability of exploitation

0.06%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628 https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1 https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974 https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230 https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797 https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041

Frequently Asked Questions

What is CVE-2026-64298? +

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMODE access mode. nfs_open_permission_mask() builds the access mask passed to nfs_may_open(), which is the local authorization gate for OPENs the client serves itself from a cached write delegation via the can_open_delegated() path in nfs4_try_open_cached(). The mask is derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a file the caller cannot write requests only MAY_READ and passes the local check. The OPEN is then satisfied locally and the truncation is issued to the server as a SETATTR(size=0) over the delegation stateid, which the server accepts under standard write-delegation semantics. POSIX requires that this open fail with EACCES. Include MAY_WRITE in the mask whenever O_TRUNC is set so the local check matches the access the server would have enforced. It has a CVSS v3.1 base score of 7.1 (HIGH).

How severe is CVE-2026-64298? +

CVE-2026-64298 has a CVSS v3.1 score of 7.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0016, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-64298? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-64298