CVE-2026-2340
Discovered by AISLEPUBLISHEDCWE-280
Description
A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.
CVSS Base Scores
CVSS v3.1(Primary)
6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Version | Status |
|---|---|---|---|
| Red Hat | Samba | 0:4.23.5-109.el10_2 | unaffected |
| Red Hat | Samba | 0:4.21.3-114.el10_0.1 | — |
| Red Hat | Samba | 0:4.19.4-16.el8_10 | — |
| Red Hat | Samba | 0:4.15.5-16.el8_6.1 | — |
| Red Hat | Samba | 0:4.17.5-7.el8_8.1 | — |
| Red Hat | Samba | 0:4.23.5-10.el9_8 | — |
| Red Hat | Samba | 0:4.17.5-105.el9_2.5 | — |
| Red Hat | Samba | 0:4.19.4-105.el9_4.4 | — |
| Red Hat | Samba | 0:4.21.3-14.el9_6.1 | — |
| Red Hat | Samba | 4.19.9.6.202606241344-0 | — |
Credits
- Red Hat would like to thank Pavel Kohout (Aisle Research) for reporting this issue.
References
- https://access.redhat.com/errata/RHSA-2026:22644
- https://access.redhat.com/errata/RHSA-2026:22963
- https://access.redhat.com/errata/RHSA-2026:25049
- https://access.redhat.com/errata/RHSA-2026:25979
- https://access.redhat.com/errata/RHSA-2026:28053
- https://access.redhat.com/errata/RHSA-2026:28054
- https://access.redhat.com/errata/RHSA-2026:28055
- https://access.redhat.com/errata/RHSA-2026:28056
- https://access.redhat.com/errata/RHSA-2026:28057
- https://access.redhat.com/errata/RHSA-2026:29863
- https://access.redhat.com/security/cve/CVE-2026-2340
- https://bugzilla.redhat.com/show_bug.cgi?id=2447318
- https://bugzilla.samba.org/show_bug.cgi?id=15997