The Samba vfs_worm module is designed to enforce WORM protections by preventing file modifications after a configurable grace period. However, CVE-2026-2340 arises because the module does not properly validate rename operations, allowing an authenticated user with write permissions to rename a newly created file over an existing WORM-protected file, effectively overwriting it. This flaw compromises the intended immutability of protected files. Red Hat has issued a security advisory and released patches for Red Hat Enterprise Linux 10 to fix this issue.

An authenticated user with write access to a Samba share can bypass WORM protections and overwrite files that should be immutable, potentially leading to unauthorized data modification. The vulnerability does not impact confidentiality or availability but has a high impact on integrity. The CVSS v3.1 base score is 6.5 (medium severity), reflecting the ease of exploitation with low attack complexity and no user interaction required.

Red Hat has released an official security update that addresses CVE-2026-2340. Users of Red Hat Enterprise Linux 10 should apply the available patches to versions 10.2 or later as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258). No additional mitigations are required beyond applying the official fix.