)]}'
{
  "commit": "e8e66bd1d91bd654ea9b0f91452b6dbc02413296",
  "tree": "7b7749a3e816e7e06b440396e3686b28b96ed2f0",
  "parents": [
    "048d0f981dfa35c3bc8e97efae6639c94f3af36e"
  ],
  "author": {
    "name": "Benjamin Coddington",
    "email": "ben.coddington@hammerspace.com",
    "time": "Thu Jun 11 17:02:15 2026 -0400"
  },
  "committer": {
    "name": "Angel Adetula",
    "email": "angeladetula@google.com",
    "time": "Sat Aug 01 14:44:16 2026 -0700"
  },
  "message": "NFSv4: include MAY_WRITE in open permission mask for O_TRUNC\n\ncommit 5140f099ecd8a2f2808b7f7b720ee1bad8468974 upstream.\n\nPOSIX requires write permission to truncate a file, so an open() that\nspecifies O_TRUNC must be authorized for write access regardless of the\nO_ACCMODE access mode.\n\nnfs_open_permission_mask() builds the access mask passed to\nnfs_may_open(), which is the local authorization gate for OPENs the\nclient serves itself from a cached write delegation via the\ncan_open_delegated() path in nfs4_try_open_cached().  The mask is\nderived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a\nfile the caller cannot write requests only MAY_READ and passes the\nlocal check.  The OPEN is then satisfied locally and the truncation is\nissued to the server as a SETATTR(size\u003d0) over the delegation stateid,\nwhich the server accepts under standard write-delegation semantics.\nPOSIX requires that this open fail with EACCES.\n\nInclude MAY_WRITE in the mask whenever O_TRUNC is set so the local\ncheck matches the access the server would have enforced.\n\nBUG\u003db/539152172\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-64298 in the Linux kernel.\n\ncos-patch: security-moderate\nSuggested-by: Trond Myklebust \u003ctrondmy@kernel.org\u003e\nFixes: af22f94ae02a (\"NFSv4: Simplify _nfs4_do_access()\")\nCc: stable@vger.kernel.org\nChange-Id: Iee2786eda1219add33fb6a9088bc5896d3fc35fc\nSigned-off-by: Benjamin Coddington \u003cbcodding@hammerspace.com\u003e\nSigned-off-by: Anna Schumaker \u003canna.schumaker@hammerspace.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/176808\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Dom Huh \u003cdomhuh@google.com\u003e\nReviewed-by: Angel Adetula \u003cangeladetula@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "50975f33aa2a4727cab8cbe6892258943e58347a",
      "old_mode": 33188,
      "old_path": "fs/nfs/dir.c",
      "new_id": "f3d0e78fadd3e10ff60e9fa2de05755678583072",
      "new_mode": 33188,
      "new_path": "fs/nfs/dir.c"
    }
  ]
}