Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64298— NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 2.6.24版本存在安全漏洞，该漏洞源于nfs_open_permission_mask函数在构建访问掩码时未包含MAY_WRITE权限，当open()指定O_TRUNC时，导致本地授权检查绕过，可能允许用户对无法写入的文件执行截断操作。

CVSS 7.1 · High EPSS 0.16% · P5

Possible ATT&CK Techniques 1 AI

T1546.015 · Component Object Model Hijacking

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux af22f94ae02ab9dd4fd7fe628c8434a59cc293be< 4817c8974315b666e895b7d1bb83cd3664c323b1 affected
af22f94ae02ab9dd4fd7fe628c8434a59cc293be< cb148a2762d644bff1894728e8835a9a4b84f9ea affected
af22f94ae02ab9dd4fd7fe628c8434a59cc293be< 30fdf4df6c3c00efec947e4ddf97f0fdd4473628 affected
af22f94ae02ab9dd4fd7fe628c8434a59cc293be< 22c1fd1355ad4ca27aa7f0fa02719122dd92d9de affected
af22f94ae02ab9dd4fd7fe628c8434a59cc293be< 6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230 affected
af22f94ae02ab9dd4fd7fe628c8434a59cc293be< a937e92c1d00534b5c2e3e9f4381b7e988180797 affected
af22f94ae02ab9dd4fd7fe628c8434a59cc293be< e36501b7d4abdcd6d69a7cb901b2f286b7a3d041 affected
af22f94ae02ab9dd4fd7fe628c8434a59cc293be< 5140f099ecd8a2f2808b7f7b720ee1bad8468974 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64298

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMODE access mode. nfs_open_permission_mask() builds the access mask passed to nfs_may_open(), which is the local authorization gate for OPENs the client serves itself from a cached write delegation via the can_open_delegated() path in nfs4_try_open_cached(). The mask is derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a file the caller cannot write requests only MAY_READ and passes the local check. The OPEN is then satisfied locally and the truncation is issued to the server as a SETATTR(size=0) over the delegation stateid, which the server accepts under standard write-delegation semantics. POSIX requires that this open fail with EACCES. Include MAY_WRITE in the mask whenever O_TRUNC is set so the local check matches the access the server would have enforced.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 2.6.24版本存在安全漏洞，该漏洞源于nfs_open_permission_mask函数在构建访问掩码时未包含MAY_WRITE权限，当open()指定O_TRUNC时，导致本地授权检查绕过，可能允许用户对无法写入的文件执行截断操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux af22f94ae02ab9dd4fd7fe628c8434a59cc293be ~ 4817c8974315b666e895b7d1bb83cd3664c323b1 -
Linux Linux 2.6.24 -

II. Public POCs for CVE-2026-64298

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64298

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64298 (8)

Same Patch Batch · Linux · 2026-07-25 · 274 CVEs total

CVE-2026-64355 9.8 CRITICAL bpf: Reject fragmented frames in devmap
CVE-2026-64459 9.8 CRITICAL tcp: restore RCU grace period in tcp_ao_destroy_sock
CVE-2026-64303 9.8 CRITICAL spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
CVE-2026-64439 9.8 CRITICAL crypto: krb5 - filter out async aead implementations at alloc
CVE-2026-64410 9.8 CRITICAL netfilter: flowtable: IPIP tunnel hardware offload is not yet support
CVE-2026-64399 9.8 CRITICAL ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
CVE-2026-64397 9.8 CRITICAL ksmbd: serialize QUERY_DIRECTORY requests per file
CVE-2026-64391 9.8 CRITICAL ksmbd: use opener credentials for ADS I/O
CVE-2026-64387 9.8 CRITICAL smb: client: fix query directory replay double-free
CVE-2026-64386 9.8 CRITICAL smb: client: fix query_info() replay double-free
CVE-2026-64385 9.8 CRITICAL smb: client: fix double-free in SMB2_ioctl() replay
CVE-2026-64383 9.8 CRITICAL smb: client: fix double-free in SMB2_flush() replay
CVE-2026-64384 9.8 CRITICAL smb: client: fix change notify replay double-free
CVE-2026-64268 9.8 CRITICAL RDMA/siw: bound Read Response placement to the RREAD length
CVE-2026-64523 9.8 CRITICAL net/handshake: Take a long-lived file reference at submit
CVE-2026-64257 9.1 CRITICAL smb: client: reject overlapping data areas in SMB2 responses
CVE-2026-64392 9.1 CRITICAL ksmbd: use opener credentials for delete-on-close
CVE-2026-64393 9.1 CRITICAL ksmbd: run set info with opener credentials
CVE-2026-64269 9.1 CRITICAL RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
CVE-2026-64319 9.1 CRITICAL nvmet-auth: validate reply message payload bounds against transfer length

Showing top 20 of 274 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64298

No comments yet

Leave a comment