CVE-2026-2340: Samba vfs_worm Privilege Escalation Flaw

CVE-2026-2340 Overview

A flaw exists in Samba's vfs_worm module that allows authenticated users to bypass write-once, read-many (WORM) protections. The module enforces immutability on files after a configurable grace period expires. However, the module fails to validate rename operations correctly. An authenticated user with write access to a share can create a new file and rename it over an existing WORM-protected file, effectively overwriting content that should be immutable. This weakness is tracked under [CWE-280: Improper Handling of Insufficient Permissions or Privileges].

Critical Impact
Authenticated attackers with share write access can overwrite WORM-protected files, undermining data integrity guarantees for compliance, audit logging, and archival storage use cases.

Affected Products

Samba server deployments using the vfs_worm VFS module
Red Hat distributions shipping affected Samba packages
File shares configured with WORM protections for compliance or archival workloads

Discovery Timeline

2026-05-27 - CVE-2026-2340 published to the National Vulnerability Database
2026-05-27 - Entry last modified in NVD

Technical Details for CVE-2026-2340

Vulnerability Analysis

The vfs_worm module is a Samba Virtual File System (VFS) layer designed to provide write-once, read-many protections. After a configured grace period passes, the module blocks modifications to files stored on a share. This behavior is commonly relied upon for audit logs, regulatory archives, and immutable backup targets.

The flaw stems from incomplete permission enforcement during rename operations. The module checks write protections on direct modification paths such as open() and write(), but it does not consistently apply the same checks when a rename overwrites an existing protected file. An authenticated user with write access to the share can create a new file, populate it with arbitrary content, and then rename it over the protected target. The rename effectively replaces the immutable file's contents, defeating the WORM guarantee.

The vulnerability requires authenticated access and only impacts data integrity. Confidentiality and availability are not directly affected. The issue does not grant elevated privileges or remote code execution.

Root Cause

The root cause is insufficient validation in the vfs_worm rename hook. The module does not verify whether the destination of a rename operation is a WORM-protected file before allowing the operation to proceed. This is a classic example of [CWE-280], where the security control is applied inconsistently across related operations.

Attack Vector

An attacker requires valid credentials and write permissions on a Samba share that uses the vfs_worm module. The attacker connects over Server Message Block (SMB), creates a new file inside the share, writes attacker-controlled content to it, and then issues a rename request targeting an existing protected file. The Samba server completes the rename without enforcing the WORM policy, replacing the protected file. Technical details are described in the Samba Bug Report #15997 and the Red Hat Bug Report #2447318.

Detection Methods for CVE-2026-2340

Indicators of Compromise

Unexpected modification timestamps on files stored under shares configured with the vfs_worm module.
SMB audit log entries showing SMB2_RENAME operations targeting paths inside WORM-protected directories.
Hash or content mismatches between archived backups and live copies of files that should be immutable.

Detection Strategies

Enable Samba full audit logging using vfs_full_audit and alert on rename operations within WORM-protected shares.
Compare cryptographic hashes of WORM-protected files against trusted baselines on a recurring schedule.
Correlate SMB session authentication events with subsequent rename activity to identify users abusing share write access.

Monitoring Recommendations

Forward Samba audit logs to a centralized log platform for retention and historical search.
Monitor for accounts with share write access performing high-volume create-then-rename sequences.
Track file integrity changes on archive shares through host-based file integrity monitoring (FIM) tooling.

How to Mitigate CVE-2026-2340

Immediate Actions Required

Identify all Samba shares that load the vfs_worm module and inventory the accounts with write access.
Apply vendor-supplied Samba updates as soon as fixed packages are available from your distribution.
Restrict share write permissions to the minimum set of accounts that require them, pending a patch.

Patch Information

Monitor the Red Hat CVE-2026-2340 Advisory and the upstream Samba Bug Report #15997 for fixed package releases. Apply the corresponding Samba update for your distribution once available and restart the smbd service to load the patched VFS module.

Workarounds

Restrict share-level write access on WORM shares to a tightly controlled service account and revoke direct user write access.
Place WORM-protected data on a filesystem that enforces immutability at the kernel layer, such as the chattr +i immutable attribute on supported Linux filesystems.
Enable SMB audit logging on affected shares and review rename activity until the patch is deployed.

bash

# Configuration example: enable audit logging and tighten share permissions
[archive]
   path = /srv/samba/archive
   vfs objects = full_audit worm
   worm:grace_period = 0
   full_audit:success = rename unlink write
   full_audit:failure = none
   full_audit:facility = LOCAL7
   full_audit:priority = NOTICE
   read list = @archive-readers
   write list = @archive-writers
   valid users = @archive-readers, @archive-writers