CVE-2026-64298: Linux Kernel Privilege Escalation Flaw

CVE-2026-64298 Overview

CVE-2026-64298 is a Linux kernel vulnerability in the NFSv4 client that allows a local user to truncate files they lack write permission to modify. The flaw resides in nfs_open_permission_mask(), which omits MAY_WRITE from the access mask when a caller invokes open() with O_TRUNC and a read-only access mode. When the client holds a cached write delegation, the local permission check succeeds and the client issues a SETATTR(size=0) over the delegation stateid, bypassing the server-side authorization the caller should have failed.

Critical Impact
Local users can truncate NFSv4 files they do not have write access to, violating POSIX semantics and enabling data destruction.

Affected Products

Linux kernel NFSv4 client
Distributions shipping affected upstream kernels
Systems using NFSv4 with write delegations enabled

Discovery Timeline

2026-07-25 - CVE-2026-64298 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64298

Vulnerability Analysis

The vulnerability is a broken access control flaw in the Linux NFSv4 client's local permission gate. POSIX requires write permission to truncate a file, so any open() specifying O_TRUNC must be authorized for write access regardless of the O_ACCMODE bits. The NFSv4 client fails to enforce this rule when serving opens from a cached write delegation.

Specifically, nfs_open_permission_mask() builds the access mask passed to nfs_may_open(). This function is the local authorization gate reached through can_open_delegated() inside nfs4_try_open_cached(). The mask is derived from O_ACCMODE alone and does not incorporate the semantic requirements of O_TRUNC.

Root Cause

The root cause is missing input validation of open flags during permission mask construction. A caller issuing open(O_RDONLY | O_TRUNC) against a file they cannot write requests only MAY_READ, and the local check passes. The client then satisfies the open locally and issues a SETATTR(size=0) to the server over the delegation stateid. The server accepts this operation under standard write-delegation semantics without re-evaluating the original caller's permissions.

Attack Vector

An authenticated local user on an NFSv4 client executes open() with O_RDONLY | O_TRUNC against a target file on an NFSv4 mount where the client holds a cached write delegation. The local check succeeds because MAY_WRITE is absent from the computed mask. The server truncates the file to zero length despite POSIX requiring the operation to fail with EACCES. Refer to the upstream fix in the Linux Kernel Change Log for the patch that adds MAY_WRITE to the mask whenever O_TRUNC is set.

Detection Methods for CVE-2026-64298

Indicators of Compromise

Unexpected zero-length files on NFSv4 exports where the modifying user lacks write permission on the file's mode bits or ACL.
NFSv4 SETATTR operations with size=0 originating from clients where the calling UID has read-only access to the target.
Kernel versions on NFS clients that predate the commits referenced in the upstream stable trees.

Detection Strategies

Audit NFSv4 server logs for SETATTR size-change operations and correlate the requesting user against filesystem ACLs to identify permission mismatches.
Enable Linux audit rules (auditctl -w <mount> -p wa) on sensitive NFSv4 mount points and alert on truncation events from unexpected UIDs.
Query kernel package inventory across the fleet to identify NFS clients running unpatched builds.

Monitoring Recommendations

Monitor for anomalous file-size drops to zero on NFSv4-exported filesystems using integrity monitoring tools.
Track NFSv4 delegation grants and correlate with subsequent SETATTR operations from delegated clients.
Alert on unexpected EACCES-absent truncation patterns in application logs that access shared NFSv4 storage.

How to Mitigate CVE-2026-64298

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable-tree commits to all NFSv4 client hosts and reboot to activate the fixed kernel.
Inventory NFSv4 clients across the environment and prioritize patching of multi-tenant systems where local users share NFS mounts.
Review NFSv4 export configurations and restrict write delegations where they are not operationally required.

Patch Information

The fix modifies nfs_open_permission_mask() to include MAY_WRITE in the access mask whenever O_TRUNC is set, ensuring the local check matches the access the server would enforce. Patches are available across multiple stable branches. See the upstream commits including 22c1fd1355ad, 30fdf4df6c3c, 4817c8974315, 5140f099ecd8, 6bd7d0a06b53, a937e92c1d00, cb148a2762d6, and e36501b7d4ab.

Workarounds

Disable NFSv4 write delegations on the server by tuning /proc/sys/fs/leases-enable or exporting with options that suppress delegation issuance until clients are patched.
Restrict local shell access on NFSv4 client systems to trusted users to reduce exposure to the local attack vector.
Apply stricter POSIX ACLs on sensitive NFSv4-exported files so truncation by unauthorized UIDs is rejected at the server even if the client check passes.

bash

# Disable NFSv4 delegations on the server as a temporary mitigation
echo 0 > /proc/sys/fs/leases-enable

# Verify installed kernel version on NFSv4 clients
uname -r