CVE-2026-2340

Summary

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 100:4.23.5-109.el10_2 < *unaffected
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support0:4.21.3-114.el10_0.1 < *unaffected
Red HatRed Hat Enterprise Linux 80:4.19.4-16.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 80:4.19.4-16.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support0:4.15.5-16.el8_6.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On0:4.15.5-16.el8_6.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service0:4.17.5-7.el8_8.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions0:4.17.5-7.el8_8.1 < *unaffected
Red HatRed Hat Enterprise Linux 90:4.23.5-10.el9_8 < *unaffected
Red HatRed Hat Enterprise Linux 90:4.23.5-10.el9_8 < *unaffected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions0:4.17.5-105.el9_2.5 < *unaffected
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions0:4.19.4-105.el9_4.4 < *unaffected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support0:4.21.3-14.el9_6.1 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.12412.86.202608241157-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.12412.86.202609082051-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.13413.92.202609080414-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.14414.92.202608172040-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.14414.92.202609011250-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.15415.92.202608180329-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.15415.92.202609140326-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.16416.94.202608150307-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.16416.94.202609011112-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.17417.94.202608250221-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.17417.94.202609191027-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.18418.94.202608142238-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.18418.94.202609031320-0 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.194.19.9.6.202606241344-0 < *unaffected

Weaknesses

  • CWE-280: Improper Handling of Insufficient Permissions or Privileges

Workarounds

Administrators can mitigate this issue by:

Setting read-only permissions on protected files at the underlying filesystem level will prevent modifications.

Configuring worm:grace_period = 0 (zero or less) in smb.conf will eliminate the writable grace period (will eliminate the window in which the rename can happen), understanding that this may impact workflows requiring multi-step file creation.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References