CVE-2026-2340

MediumCVSS 6.5/10Last modified Oct 15, 2026

Description

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-280

Affected software

No affected versions have been published.

Timeline

Published
May 27, 2026
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-234005.5In the Linux kernel, the following vulnerability has been resolved: rust_binder: call set_notification_done() without proc lock Consider tCVE-2026-234015.5In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIOCVE-2026-234025.5In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present CVE-2026-234035.5In the Linux kernel, the following vulnerability has been resolved: apparmor: fix memory leak in verify_header The function sets `*ns = NUCVE-2026-234045.5In the Linux kernel, the following vulnerability has been resolved: apparmor: replace recursive profile removal with iterative approach ThCVE-2026-234055.5In the Linux kernel, the following vulnerability has been resolved: apparmor: fix: limit the number of levels of policy namespaces CurrentCVE-2026-234067.8In the Linux kernel, the following vulnerability has been resolved: apparmor: fix side-effect bug in match_char() macro usage The match_chCVE-2026-234077.8In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds check on DEFAULT table in verify_dfa() ThCVE-2026-234087.8In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix double free of ns_name in aa_replace_profiles() if ns_naCVE-2026-234095.5In the Linux kernel, the following vulnerability has been resolved: apparmor: fix differential encoding verification Differential encodingCVE-2026-234107.8In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition thCVE-2026-234117.8In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor w