Skip to main content

Samba vfs_worm EUVDEUVD-2026-32312

| CVE-2026-2340 MEDIUM
Improper Handling of Insufficient Permissions or Privileges (CWE-280)
2026-05-27 secalert@redhat.com GHSA-m6w2-p258-gxqp
6.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
Analysis Generated
May 27, 2026 - 21:34 vuln.today

DescriptionCVE.org

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

AnalysisAI

WORM protection bypass in Samba's vfs_worm VFS module allows authenticated share users to defeat data retention controls by renaming a newly created file over an existing WORM-protected file. Affected users are those operating Samba deployments that have explicitly enabled the vfs_worm module for write-once, read-many data protection - such as compliance, archival, or audit log shares. An attacker with low-privilege write access can silently overwrite files that should be immutable post-grace-period, with high integrity impact (CVSS I:H). No public exploit or CISA KEV listing is identified at time of analysis.

Technical ContextAI

Samba's Virtual File System (VFS) layer supports pluggable modules that intercept filesystem operations. The vfs_worm module is one such plugin, designed to enforce WORM semantics: once a file's configurable grace period expires, write operations to it are blocked. The vulnerability arises from CWE-280 (Improper Handling of Insufficient Permissions or Privileges) - specifically, the module's permission validation logic does not correctly handle rename(2) system calls that target a protected file. A rename that resolves to an existing WORM-protected destination is not subjected to the same immutability check applied to direct write operations, creating a logic gap between the rename path and the write-protection enforcement path. The underlying Samba VFS dispatch for rename operations was reported via Samba bugzilla #15997 and Red Hat Bugzilla #2447318, both linked from NVD. No CPE strings were supplied with this advisory, so exact version ranges are not confirmed from the provided data.

RemediationAI

No vendor-released patch version was identified in the provided data at time of analysis - the upstream bug report at https://bugzilla.samba.org/show_bug.cgi?id=15997 should be monitored for fix commits and patched release announcements. As a primary compensating control, organizations should evaluate whether the vfs_worm module is strictly necessary; if not, disabling it removes the attack surface entirely (note: this also removes WORM protections, which may violate compliance requirements). If vfs_worm must remain enabled, restricting write access to WORM shares to only the minimum required user accounts via Samba share-level ACLs (valid users, write list) limits the pool of potential attackers to explicitly authorized principals. Filesystem-level WORM enforcement provided by the underlying storage platform (e.g., NetApp SnapLock, ZFS immutability flags, object-lock on S3-compatible backends) can serve as a defense-in-depth layer that does not rely on Samba's VFS module. Red Hat's advisory at https://access.redhat.com/security/cve/CVE-2026-2340 should be consulted for distribution-specific package updates.

CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

CVE-2017-1000253 HIGH POC
7.8 Oct 05

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7

CVE-2017-5645 CRITICAL POC
9.8 Apr 17

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events

CVE-2015-0240 CRITICAL POC
10.0 Feb 24

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1

CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2

CVE-2025-32463 CRITICAL POC
9.3 Jun 30

Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Affected
Image SLES15-SP7-HPC-Azure Affected
SUSE Enterprise Storage 7.1 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 12 SP5 Fixed

Share

EUVD-2026-32312 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy