Executive brief
A security flaw has been identified in Samba, a widely used software suite that allows Linux and Unix systems to share files with Windows computers. Under certain conditions, an authorized user could modify or delete file metadata on a network share even if that share is specifically set to 'read-only' mode. This could allow an attacker to disrupt operations by making files inaccessible or redirecting users to different files, potentially leading to a service outage or data integrity issues.
Technical details
A vulnerability exists in Samba's handling of NTFS-style reparse points due to missing SMB-layer access checks. On shares configured with 'read only = yes', authenticated users who possess underlying filesystem-level write permissions can still create or delete reparse point metadata via SMB operations. This bypasses the intended read-only restriction of the SMB export. An attacker can exploit this to convert files into symbolic links or other reparse point types, potentially leading to a denial of service or unauthorized modification of file behavior. The issue affects Samba versions 4.1 and newer. Patches have been developed for various branches including 4.21, 4.22, 4.23, and 4.24.
Affected products
- Samba Samba 4.1 and newer
Timeline
- 2026-02-04: other: Vulnerability reported to Samba developers
- 2026-05-27: disclosed: Embargo lifted and CVE published
- 2026-05-27: advisory