Samba: vfs_worm does not block directory modification (CVE-2026-2340)

Why this deserves its current priority

CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Red Hat/openshift/ose-rhel-coreos-8 (generic), Red Hat/samba (generic). Check affected ranges and fixed versions before updating.

Affected products and reported versions
Product	Affected versions	Fixed versions
cpe:2.3:a:redhat:openshift_container_platform:4.0:::::::*	Not reported	Not reported
cpe:2.3:a:samba:samba::::::::	Not reported	Not reported
cpe:2.3:o:redhat:enterprise_linux:10.0:::::::*	Not reported	Not reported
cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*	Not reported	Not reported
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*	Not reported	Not reported
cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*	Not reported	Not reported

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Red Hat/openshift/ose-rhel-coreos-8generic	*	Not reported
Red Hat/sambageneric	*	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/openshift/ose-rhel-coreos-8, Red Hat/samba.
Review the reported fix. Source-reported workaround: Administrators can mitigate this issue by: Setting read-only permissions on protected files at the underlying filesystem level will prevent modifications. Configuring ```worm:grace_period = 0``` (zero or less) in smb.conf will eliminate the writable grace period (will eliminate the window in which the rename can happen), understanding that this may impact workflows requiring multi-step file creation.

Evidence timeline and material changes

Published upstream
May 27, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jun 23, 2026

Sources and claim methodology

Upstream source description

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

Quoted source text, attributed separately from HOL analysis.

Samba: vfs_worm does not block directory modificationCVE-2026-2340