Samba: vfs_worm does not block directory modification

Description

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

Timeline

Scores

EPSS (exploitation in 30 days)

0.95% · top 39% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• CWE-280: Improper Handling of Insufficient Permissions or Privileges (opens in a new tab)All about CWE-280 and its CVEs

Affected products

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:4.23.5-109.el10_2 – < *

• Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support

  • unaffected 0:4.21.3-114.el10_0.1 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:4.19.4-16.el8_10 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:4.19.4-16.el8_10 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • unaffected 0:4.15.5-16.el8_6.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

  • unaffected 0:4.15.5-16.el8_6.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • unaffected 0:4.17.5-7.el8_8.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • unaffected 0:4.17.5-7.el8_8.1 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:4.23.5-10.el9_8 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:4.23.5-10.el9_8 – < *

• Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

  • unaffected 0:4.17.5-105.el9_2.5 – < *

• Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

  • unaffected 0:4.19.4-105.el9_4.4 – < *

• Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support

  • unaffected 0:4.21.3-14.el9_6.1 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.12

  • unaffected 412.86.202608241157-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.12

  • unaffected 412.86.202609082051-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.13

  • unaffected 413.92.202609080414-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.13

  • unaffected 413.92.202609302032-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.14

  • unaffected 414.92.202608172040-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.14

  • unaffected 414.92.202609011250-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.15

  • unaffected 415.92.202608180329-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.15

  • unaffected 415.92.202609140326-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.16

  • unaffected 416.94.202608150307-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.16

  • unaffected 416.94.202609011112-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.17

  • unaffected 417.94.202608250221-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.17

  • unaffected 417.94.202609191027-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.18

  • unaffected 418.94.202608142238-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.18

  • unaffected 418.94.202609031320-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.19

  • unaffected 4.19.9.6.202606241344-0 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unknown

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unknown

• Red Hat · Red Hat Enterprise Linux 7

  All versions: affected

What to do

Workaround: Administrators can mitigate this issue by: Setting read-only permissions on protected files at the underlying filesystem level will prevent modifications. Configuring ```worm:grace_period = 0``` (zero or less) in smb.conf will eliminate the writable grace period (will eliminate the window in which the rename can happen), understanding that this may impact workflows requiring multi-step file creation.

References (27)

• RHSA-2026:22644 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:22963 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:25049 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:25979 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:28053 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:28054 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:28055 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:28056 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:28057 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:29863 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:56786 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:56853 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:56911 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:57483 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:59831 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:60019 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:62409 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:62549 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:65839 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:65851 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:65907 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:67857 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:70586 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:77320 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/security/cve/CVE-2026-2340 (opens in a new tab)vdb-entryx_refsource_REDHAT
• RHBZ#2447318 (opens in a new tab)issue-trackingx_refsource_REDHAT
• https://bugzilla.samba.org/show_bug.cgi?id=15997 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-2340](https://trackcve.app/badge/CVE-2026-2340.svg)](https://trackcve.app/cve/CVE-2026-2340)

Record last updated 5 Nov 2026, 19:31 UTC.