Improper access control in Linux kernel - CVE-2026-64298
Published: July 27, 2026
Vulnerability identifier: #VU139693
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64298
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to bypass file write permission checks and truncate a file.
The vulnerability exists due to improper access control in nfs_open_permission_mask() when handling open requests with O_TRUNC on NFSv4 delegated opens. A local user can open a file with O_RDONLY | O_TRUNC to bypass file write permission checks and truncate a file.
This issue occurs when the client satisfies the OPEN locally from a cached write delegation and then sends truncation to the server using delegation state.
Affected software
Linux kernel
How to mitigate CVE-2026-64298
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de
- https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628
- https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1
- https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974
- https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230
- https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797
- https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea
- https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041