The Linux kernel’s NFSv4 implementation builds an access mask when a file is opened for truncation. The flaw causes the mask to omit the required write bit when O_TRUNC is set, so an open(O_RDONLY|O_TRUNC) passes the local check and the kernel sends a SETATTR(size=0) to the server. This violates POSIX requirements and allows a client to silently truncate a file it should not be able to modify, exposing the system to uncontrolled data loss without enabling code execution or privilege escalation.

Linux kernel versions that have not incorporated the commit that adds the missing write permission bit are vulnerable. This includes the generic kernel shipped with mainstream distributions as well as downstream kernels such as Linux 7.2 rc1 and rc2, and any kernel that matches the CPE string cpe:2.3:o:linux:linux_kernel:*.

The CVSS score of 7.1 classifies the flaw as medium severity, and the EPSS score of less than 1% combined with its absence from the KEV catalog indicates low current exploitation likelihood. An attacker would need to be an NFS client that has obtained a write delegation for the target file; otherwise the kernel’s local checks would block the truncation request. Based on the description, it is inferred that a typical exploit would involve a privileged user or service initiating open(O_TRUNC) on a file it can only read, causing silent truncation of the file.