Bug 2552136 (CVE-2026-109411)

Summary: CVE-2026-109411 samba: Access control bypass via vfs_ceph_rgw case-insensitive open
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-10-23   

Description OSIDB Bzimport 2026-10-14 10:20:26 UTC 
On shares using the vfs_ceph_rgw module, the module's openat() implementation ignored the (possibly case-corrected) filename supplied by the file server and instead re-opened the name originally sent by
the client.

When a client opened an existing file using a different case than it exists on disk with a create disposition of FILE_OPEN_IF, the case-insensitive lookup failed inside the module. The file server then treated the request as a file creation, checking only the caller's permission to add a file to
the parent directory and skipping the access check on the existing object. The subsequent open then collided with, and re-opened, the existing object.

As a result an authenticated user could read or overwrite files owned by another user, despite those files having restrictive permissions.