Brief Summary: Samba CVE-2026-1933 Read-Only Share Bypass via Reparse Point Access Check Flaw

Introduction

A missing access check in Samba's reparse point handling lets authenticated users silently subvert the read only = yes share directive, one of the most fundamental security boundaries administrators configure on SMB exports. Consider any organization running Samba 4.21 or later with read-only shares where users also hold write permissions on the underlying filesystem. For that organization, CVE-2026-1933 means the "read only" label on those shares has been only a suggestion in every release since the reparse point feature shipped.

The vulnerability is scored CVSS 7.1 (High). It was disclosed and patched on May 26, 2026, as part of a larger Samba security release that also fixes two unauthenticated remote code execution flaws. The combination makes this one of the more consequential Samba updates in recent memory.

Technical Information

Root Cause: Missing SMB Layer Access Checks on Reparse Point Operations

Samba 4.21 added support for creating and deleting NTFS-style reparse points over the SMB protocol. Samba stores reparse point metadata in two extended attributes on the underlying filesystem:

user.SmbReparse: Contains the reparse point data itself
user.DosAttrib: Carries the FILE_ATTRIBUTE_REPARSE_POINT bit flag

Writing to these xattrs requires filesystem-level write permissions on the underlying file. The code path that handles reparse point set and delete operations, however, never consulted Samba's own higher-level access enforcement. It checked neither the read only = yes share directive nor read-only file handle semantics before it allowed changes to the reparse point xattrs.

This is a classic case of a new feature added without being integrated into the existing authorization framework. Every other write operation on a read only = yes share goes through SMB-layer access checks that deny it. The reparse point code path skipped that step.

The vulnerability is classified under CWE-284: Improper Access Control, which MITRE defines as "the product does not restrict or incorrectly restricts access to a resource from an unauthorized actor."

CVSS Vector Breakdown

The CVSS v3 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H breaks down as follows:

Component	Value	Interpretation
Attack Vector	Network	Exploitable remotely over SMB
Attack Complexity	Low	No special conditions required
Privileges Required	Low	Any authenticated user is sufficient
User Interaction	None	No victim action needed
Scope	Unchanged	Impact confined to the vulnerable component
Confidentiality	None	No direct information disclosure
Integrity	Low	Modification of file metadata and behavior
Availability	High	Can render files or entire filesystems unusable

Availability is rated High. An attacker can convert every file on a share into a reparse point type (most commonly a symbolic link), which leaves the whole export unusable for legitimate clients.

Attack Flow

Exploitation requires all three of these preconditions at once:

Valid SMB credentials for the Samba server. Any low-privilege account is sufficient.
Network access to the SMB service over the standard TCP port 445.
Write permissions at the filesystem level. The attacker's mapped POSIX user must be able to write to at least one file within a share configured with read only = yes.

With those in place, the attack runs like this:

The attacker authenticates to the Samba server and connects to a share marked read only = yes.
The attacker issues an SMB reparse point set operation against a target file. This operation modifies the user.SmbReparse xattr and sets the FILE_ATTRIBUTE_REPARSE_POINT bit in user.DosAttrib.
The reparse point code path does not check the share's read-only configuration or the file handle's access mode, so the server processes the operation successfully.
All SMB clients, Windows and Linux alike, now see the target file as a reparse point, most commonly a symbolic link pointing to an attacker-controlled path.

The most prominent exploitation scenario is converting existing files into symbolic links. That could redirect client file access to unintended locations on the server and allow access to data outside the intended share boundary. At scale, an attacker could convert every file on a share into a symlink and make the entire export unusable, a denial-of-service condition.

The denial of service is reversible. An administrator can restore normal operation by removing the user.SmbReparse xattr and clearing the FILE_ATTRIBUTE_REPARSE_POINT bit from user.DosAttrib on the affected files, using tools such as setfattr.

The Permission Model Tension

The vulnerability exposes a common but dangerous configuration: the same user accounts have SMB access to read-only shares and also have direct filesystem write permissions through SSH, local access, or some other non-SMB path. Administrators often assume that read only = yes at the SMB layer gives complete protection regardless of the underlying filesystem permissions. CVE-2026-1933 shows that the assumption has been wrong for reparse point operations since Samba 4.21.

Patch Information

The Samba project released upstream security patches on May 26, 2026, in three new stable releases:

Release	Replaces	Download
Samba 4.24.3	4.24.2	Available from `download.samba.org/pub/samba/stable/`
Samba 4.23.8	4.23.7	Available from `download.samba.org/pub/samba/stable/`
Samba 4.22.10	4.22.9	Available from `download.samba.org/pub/samba/stable/`

All three releases are signed with GnuPG key ID AA99442FB680B620. Incremental diff files (e.g., samba-4.24.2-4.24.3.diffs.gz) are also available for anyone building from source.

The fix adds the required access checks, so Samba now enforces its own share-level and handle-level read-only semantics before it permits any modification to the reparse point xattrs. Volker Lendecke and Stefan Metzmacher of the Samba team wrote the patch, and Asim Viladi Oglu Manizada reported the vulnerability. The fix is tracked as Samba Bug #15992.

The same releases patch five more CVEs (CVE-2026-2340, CVE-2026-3012, CVE-2026-3238, CVE-2026-4408, CVE-2026-4480), two of them unauthenticated RCE vulnerabilities. That makes the upgrade critical for reasons well beyond CVE-2026-1933.

Downstream Distribution Patches

Ubuntu: USN-8306-1 published May 26, 2026. Fixed packages for Ubuntu 26.04 LTS (2:4.23.6+dfsg-1ubuntu2.1) and Ubuntu 25.10 (2:4.22.3+dfsg-4ubuntu2.4). Older releases (24.04 LTS, 22.04 LTS) are not affected because their Samba versions predate reparse point support, which arrived in 4.21.
Debian: Fixed in trixie (security) at version 2:4.22.8+dfsg-0+deb13u2 and in sid at 2:4.24.3+dfsg-1. Bullseye and bookworm are not affected. Tracked at the Debian Security Tracker.
SUSE: Advisory SUSE-SU-2026:2076-1 (rated critical), with the fix in Samba package version 4.21.10+git.501.277ba349a01-150700.3.26.1 for SUSE Linux Enterprise 15 SP7.
Red Hat: RHSA-2026:7292, with a security impact rating of Important.
Amazon Linux 2 and Amazon Linux 2023: Confirmed not affected, because their Samba packages do not include the vulnerable reparse point feature.

Workaround for Deferred Patching

For organizations that cannot upgrade right away, the Samba team gives an official workaround: make sure that users who access a read only = yes share do not have filesystem-level write permission to the exported files. To do this, adjust the POSIX permissions on exported directories and files so that SMB user accounts have read-only access at the filesystem level. The workaround may not be feasible where the same users legitimately need filesystem write access for non-SMB workflows.

Affected Systems and Versions

All Samba versions from 4.21 up to the fixed releases listed below are affected. The reparse point feature arrived in Samba 4.21, so earlier versions are not vulnerable.

Affected version ranges:

Samba 4.21.x (all releases)
Samba 4.22.x through 4.22.9
Samba 4.23.x through 4.23.7
Samba 4.24.x through 4.24.2

Fixed versions:

Samba 4.22.10
Samba 4.23.8
Samba 4.24.3

The vulnerable configuration requires a share with read only = yes where authenticated SMB users also have POSIX write permissions on the underlying exported files. Shares where users lack filesystem write permissions are not exploitable, even on unpatched versions.

Distributions confirmed not affected include Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Debian bullseye, Debian bookworm, Amazon Linux 2, and Amazon Linux 2023, because their Samba packages predate the feature introduced in 4.21.

Vendor Security History

The Samba project has published security disclosures since 2001 and keeps them on its security updates page. The project follows a responsible disclosure model and has historically provided timely patches. Notable past vulnerabilities include CVE-2016-2124 and CVE-2020-25717 (both related to authentication and authorization flaws) and CVE-2024-12085 (information disclosure in Samba Rsync).

The May 26, 2026 security release is larger than average, with six CVEs patched at once. Two unauthenticated RCE vulnerabilities (CVE-2026-4408 in the DCE/RPC SAMR server and CVE-2026-4480 in the printing subsystem) shipping alongside CVE-2026-1933 suggest that the 4.21 codebase picked up several security regressions as new features were added. New features opening access control gaps is consistent with the broader CWE-284 category, and it shows the risk of expanding SMB protocol features without a proportionate security review.

The Samba team's stated philosophy is "Our Code, Our Bugs, Our Responsibility." The coordinated multi-version release, with standalone patch files and signed tarballs, reflects a mature security response process.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical Information