Description
A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.
Metrics
CVSS 3.1 6.5/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — |
| Red Hat | Red Hat Enterprise Linux 6 | — |
| Red Hat | Red Hat Enterprise Linux 6 | — |
| Red Hat | Red Hat Enterprise Linux 7 | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — |
References
- https://access.redhat.com/errata/RHSA-2026:22644
- https://access.redhat.com/errata/RHSA-2026:22963
- https://access.redhat.com/errata/RHSA-2026:25049
- https://access.redhat.com/errata/RHSA-2026:25979
- https://access.redhat.com/errata/RHSA-2026:28053
- https://access.redhat.com/errata/RHSA-2026:28054
- https://access.redhat.com/errata/RHSA-2026:28055
- https://access.redhat.com/errata/RHSA-2026:28056
- https://access.redhat.com/errata/RHSA-2026:28057
- https://access.redhat.com/errata/RHSA-2026:29863
- https://access.redhat.com/errata/RHSA-2026:54581
- https://access.redhat.com/errata/RHSA-2026:54599
- https://access.redhat.com/errata/RHSA-2026:54769
- https://access.redhat.com/errata/RHSA-2026:56786
- https://access.redhat.com/errata/RHSA-2026:56853
- https://access.redhat.com/errata/RHSA-2026:56911
- https://access.redhat.com/errata/RHSA-2026:57483
- https://access.redhat.com/errata/RHSA-2026:59831
- https://access.redhat.com/errata/RHSA-2026:60019
- https://access.redhat.com/errata/RHSA-2026:65839
- https://access.redhat.com/security/cve/CVE-2026-1933Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2447317Issue Tracking, Third Party Advisory
- https://bugzilla.samba.org/show_bug.cgi?id=15992Issue Tracking, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:22644
- https://access.redhat.com/errata/RHSA-2026:22963
- https://access.redhat.com/errata/RHSA-2026:25049
- https://access.redhat.com/errata/RHSA-2026:25979
- https://access.redhat.com/errata/RHSA-2026:28053
- https://access.redhat.com/errata/RHSA-2026:28054
- https://access.redhat.com/errata/RHSA-2026:28055
- https://access.redhat.com/errata/RHSA-2026:28056
- https://access.redhat.com/errata/RHSA-2026:28057
- https://access.redhat.com/errata/RHSA-2026:29863
- https://access.redhat.com/errata/RHSA-2026:54581
- https://access.redhat.com/errata/RHSA-2026:54599
- https://access.redhat.com/errata/RHSA-2026:54769
- https://access.redhat.com/errata/RHSA-2026:56786
- https://access.redhat.com/errata/RHSA-2026:56853
- https://access.redhat.com/errata/RHSA-2026:56911
- https://access.redhat.com/errata/RHSA-2026:57483
- https://access.redhat.com/errata/RHSA-2026:59831
- https://access.redhat.com/errata/RHSA-2026:60019
- https://access.redhat.com/errata/RHSA-2026:65839
- https://access.redhat.com/security/cve/CVE-2026-1933Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2447317Issue Tracking, Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1933.json
Timeline
- Published
- May 27, 2026
- Last modified
- Nov 4, 2026
- NVD status
- Modified