In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMODE access mode. nfs_open_permission_mask() builds the access mask passed to nfs_may_open(), which is the local authorization gate for OPENs the client serves itself from a cached write delegation via the can_open_delegated() path in nfs4_try_open_cached(). The mask is derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a file the caller cannot write requests only MAY_READ and passes the local check. The OPEN is then satisfied locally and the truncation is issued to the server as a SETATTR(size=0) over the delegation stateid, which the server accepts under standard write-delegation semantics. POSIX requires that this open fail with EACCES. Include MAY_WRITE in the mask whenever O_TRUNC is se
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64298 is a privilege escalation vulnerability in the Linux kernel's NFSv4 implementation where the open() system call with O_TRUNC flag fails to properly enforce write permission checks. When a process attempts to truncate a file through open(), the kernel should mandate write access authorization regardless of the specified access mode (O_RDONLY, O_WRONLY, O_RDWR). This vulnerability affects any Linux system serving or consuming NFSv4 mounts, potentially allowing unprivileged users to truncate files they should not have write access to. The impact is significant in multi-tenant environments, container deployments, and any infrastructure relying on NFSv4 for file sharing where permission isolation is critical for security boundaries.
Casky's AI-powered analysis would correlate this vulnerability with access control and privilege escalation patterns across MITRE ATT&CK. Practitioners using Casky would identify detection signals aligned with techniques like Abuse of Elevation Control Mechanism (T1548) and Exploitation for Privilege Escalation (T1190), particularly in forensic analysis of NFSv4 mount activities and unexpected file truncations. While this CVE maps to zero MITRE techniques currently, Casky's extended reasoning capability would help security teams understand the authorization bypass nature of this flaw by analyzing system call tracing data, NFSv4 delegation logs, and file permission change events—enabling detection of exploitation attempts before successful privilege escalation occurs in kernel-level file operations.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64298. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation