CVE-2026-64298
Description
A flaw was found in the Linux kernel's NFSv4 implementation. A local user could exploit a vulnerability where opening a file with O_TRUNC (truncate) and O_RDONLY (read-only) flags would bypass the necessary write permission checks. This oversight allows an attacker to truncate a file without having explicit write access, leading to unauthorized data modification.
Statement
This vulnerability is classified as having a Moderate severity for Red Hat Enterprise Linux because exploitation is restricted to authenticated local users on an NFSv4 client and requires specific timing where an active write delegation is already cached for the target file. Although an unprivileged account can truncate files without possessing appropriate write rights—thereby impacting data integrity and availability—the flaw cannot be exploited across the network without local access and does not enable privilege escalation or arbitrary code execution.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 7.1 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
