CVE-2026-1933
Description
A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.
Statement
This vulnerability is rated Important severity by Red Hat Product Security, because authenticated users with filesystem-level write permissions may bypass Samba’s SMB-layer read-only protections for reparse point operations.
The flaw affects shares configured with "read only = yes", where Samba failed to properly enforce access checks when setting or deleting reparse point metadata. An attacker with existing write permissions on the underlying filesystem may manipulate SMB reparse point metadata to alter how files are presented to SMB clients, including converting files into symbolic links.
The vulnerability does not bypass underlying filesystem access controls or grant additional operating system privileges. However, successful exploitation may significantly disrupt file access for users of the affected share, including making large portions of a shared filesystem unavailable through widespread reparse point modification. Because the attack requires authenticated access and existing filesystem write permissions, Privileges Required are assessed as Low (PR:L).
This vulnerability affects Samba versions beginning with the introduction of NTFS-style reparse point support in Samba 4.21.
Mitigation
Administrators can mitigate this issue by ensuring users who access a read only = yes Samba share do not have filesystem-level write permission to the exported files.
A server administrator may also monitor and remove unintended "user.SmbReparse" xattr (extended attributes) and the associated FILE_ATTRIBUTE_REPARSE_POINT "user.DosAttrib" bit metadata if exploitation is suspected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | 6.5 | 7.1 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | Low | High | Low |
| Availability Impact | High | None | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Acknowledgements
Red Hat would like to thank Asim Viladi Oglu Manizada for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
