CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

POSIX requires write permission to truncate a file, so an open() that
specifies O_TRUNC must be authorized for write access regardless of the
O_ACCMODE access mode.

nfs_open_permission_mask() builds the access mask passed to
nfs_may_open(), which is the local authorization gate for OPENs the
client serves itself from a cached write delegation via the
can_open_delegated() path in nfs4_try_open_cached().  The mask is
derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a
file the caller cannot write requests only MAY_READ and passes the
local check.  The OPEN is then satisfied locally and the truncation is
issued to the server as a SETATTR(size=0) over the delegation stateid,
which the server accepts under standard write-delegation semantics.
POSIX requires that this open fail with EACCES.

Include MAY_WRITE in the mask whenever O_TRUNC is set so the local
check matches the access the server would have enforced.

The Linux kernel CVE team has assigned CVE-2026-64298 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.24 with commit af22f94ae02ab9dd4fd7fe628c8434a59cc293be and fixed in 5.10.261 with commit 4817c8974315b666e895b7d1bb83cd3664c323b1
	Issue introduced in 2.6.24 with commit af22f94ae02ab9dd4fd7fe628c8434a59cc293be and fixed in 5.15.212 with commit cb148a2762d644bff1894728e8835a9a4b84f9ea
	Issue introduced in 2.6.24 with commit af22f94ae02ab9dd4fd7fe628c8434a59cc293be and fixed in 6.1.178 with commit 30fdf4df6c3c00efec947e4ddf97f0fdd4473628
	Issue introduced in 2.6.24 with commit af22f94ae02ab9dd4fd7fe628c8434a59cc293be and fixed in 6.6.145 with commit 22c1fd1355ad4ca27aa7f0fa02719122dd92d9de
	Issue introduced in 2.6.24 with commit af22f94ae02ab9dd4fd7fe628c8434a59cc293be and fixed in 6.12.96 with commit 6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230
	Issue introduced in 2.6.24 with commit af22f94ae02ab9dd4fd7fe628c8434a59cc293be and fixed in 6.18.39 with commit a937e92c1d00534b5c2e3e9f4381b7e988180797
	Issue introduced in 2.6.24 with commit af22f94ae02ab9dd4fd7fe628c8434a59cc293be and fixed in 7.1.4 with commit e36501b7d4abdcd6d69a7cb901b2f286b7a3d041
	Issue introduced in 2.6.24 with commit af22f94ae02ab9dd4fd7fe628c8434a59cc293be and fixed in 7.2-rc3 with commit 5140f099ecd8a2f2808b7f7b720ee1bad8468974

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64298
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nfs/dir.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1
	https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea
	https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628
	https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de
	https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230
	https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797
	https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041
	https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974