The Linux kernel's NFSv4 client incorrectly authorized open() calls with the O_TRUNC flag without requiring write permission, due to the local permission mask being derived solely from O_ACCMODE. This allowed a client to locally satisfy an open(O_RDONLY | O_TRUNC) call and issue a truncation request to the server, which accepted it under write delegation semantics. POSIX requires that truncation operations require write permission and that such opens fail with EACCES if write access is not granted. The fix includes adding MAY_WRITE to the open permission mask when O_TRUNC is specified, aligning local checks with server enforcement.

This vulnerability could allow a client to truncate a file without proper write authorization, violating POSIX access control expectations. This could lead to unauthorized data modification or loss on NFSv4-mounted filesystems if exploited. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to include write permission in the open permission mask when O_TRUNC is used. Users should apply the official kernel updates that contain this fix. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed here; users should consult the Linux kernel vendor advisory for the specific fixed versions and update accordingly.