From c74d946de26deeba6c42c558e0913b23d019c0b9 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Mon, 2 Feb 2026 11:43:37 +0100 Subject: [PATCH] WIP: CVE-2026-1933 smbd: Add access checks to reparse point operations On a share marked "read only = yes" and on file handles opened R/O users can set or delete the reparse point xattrs on files that the user has write-access in the file system for. Add the required access checks. Thanks to Asim Viladi Oglu Manizada for reporting the issue. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15992 Signed-off-by: Volker Lendecke --- source3/modules/util_reparse.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/source3/modules/util_reparse.c b/source3/modules/util_reparse.c index 60373d7fd4e..75af0a9d506 100644 --- a/source3/modules/util_reparse.c +++ b/source3/modules/util_reparse.c @@ -320,6 +320,11 @@ NTSTATUS fsctl_set_reparse_point(struct files_struct *fsp, return NT_STATUS_ACCESS_DENIED; } + if (!fsp->fsp_flags.can_write) { + DBG_DEBUG("Access denied on a readonly handle\n"); + return NT_STATUS_ACCESS_DENIED; + } + status = reparse_buffer_check(in_data, in_len, &reparse_tag, @@ -390,6 +395,11 @@ NTSTATUS fsctl_del_reparse_point(struct files_struct *fsp, uint32_t dos_mode; int ret; + if (!fsp->fsp_flags.can_write) { + DBG_DEBUG("Access denied on a readonly handle\n"); + return NT_STATUS_ACCESS_DENIED; + } + status = fsctl_get_reparse_tag(fsp, &existing_tag); if (!NT_STATUS_IS_OK(status)) { return status; -- 2.51.0