CVE-2026-1933

Summary

A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 100:4.23.5-109.el10_2 < *unaffected
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support0:4.21.3-114.el10_0.1 < *unaffected
Red HatRed Hat Enterprise Linux 80:4.19.4-16.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 80:4.19.4-16.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support0:4.15.5-16.el8_6.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On0:4.15.5-16.el8_6.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service0:4.17.5-7.el8_8.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions0:4.17.5-7.el8_8.1 < *unaffected
Red HatRed Hat Enterprise Linux 90:4.23.5-10.el9_8 < *unaffected
Red HatRed Hat Enterprise Linux 90:4.23.5-10.el9_8 < *unaffected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions0:4.17.5-105.el9_2.5 < *unaffected
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions0:4.19.4-105.el9_4.4 < *unaffected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support0:4.21.3-14.el9_6.1 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.194.19.9.6.202606241344-0 < *unaffected

Weaknesses

  • CWE-284: Improper Access Control

Workarounds

Administrators can mitigate this issue by ensuring users who access a read only = yes Samba share do not have filesystem-level write permission to the exported files.

A server administrator may also monitor and remove unintended "user.SmbReparse" xattr (extended attributes) and the associated FILE_ATTRIBUTE_REPARSE_POINT "user.DosAttrib" bit metadata if exploitation is suspected.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

samba: Missing access check on reparse point operations

Additional References

References