A flaw in the Linux kernel NFSv4 subsystem allows local users to perform unauthorized file truncations, potentially leading to data loss or system instability.

This is an improper access control vulnerability within the nfs_open_permission_mask function. An authenticated local user can bypass POSIX write requirements by using the O_TRUNC flag during a file open operation, causing the kernel to incorrectly authorize the request via a cached write delegation.

Successful exploitation allows a local user with restricted access to overwrite or delete the contents of files they should not have permission to modify. Given the CVSS score of 7.1, this vulnerability poses a significant risk to data integrity and system availability, as an attacker could potentially corrupt critical system files or application data by truncating them to zero length.

Immediate Action: Update the Linux kernel to the patched versions: 5.10.261, 5.15.212, 6.1.178, 6.6.145, or newer releases as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for unusual file access patterns, particularly those involving frequent truncation or unexpected file size changes by local users.

Compensating Controls: Ensure that local file system permissions are strictly enforced and limit user access to sensitive directories where possible to reduce the potential impact of local privilege escalation or unauthorized file modification.

Public Exploit Available: Unknown

This vulnerability represents a significant security oversight in the NFSv4 implementation that affects local security boundaries. Organizations running affected Linux kernels should prioritize patching to prevent potential unauthorized data destruction by local actors. Please verify the kernel version currently in use and apply the relevant security updates provided by your distribution maintainer as soon as they become available.