The Linux kernel’s NFSv4 implementation constructs an access mask when a file is opened for truncation. The flaw causes the mask to omit the required write bit when O_TRUNC is set, so an open(O_RDONLY|O_TRUNC) passes the local check and the kernel sends a SETATTR(size=0) to the server. This violates POSIX requirements and allows a client to silently truncate a file it should not be able to modify, exposing the system to uncontrolled data loss without enabling code execution or privilege escalation.

Linux kernels that have not yet incorporated the commit adding the missing write permission bit for open with O_TRUNC are vulnerable. This includes the generic kernels shipped with mainstream distributions as well as downstream kernels such as Linux 7.2 release candidates 1 and 2, and any kernel that belongs to the Linux kernel family.

The CVSS score of 7.1 classifies the flaw as medium severity, and the EPSS score of less than 1% combined with its absence from the KEV catalog indicates a low current exploitation likelihood. An attacker would need to be an NFS client that has obtained a write delegation for the target file; otherwise the local checks would block the truncation request. Based on the description, it is inferred that a typical exploit would involve a privileged user or service initiating open(O_TRUNC) on a file it can only read, causing silent truncation of the file.