The Samba server is supposed to only grant access to configured share directories unless 'wide links' are enabled, in which case the server is allowed to follow symlinks. The default (since CVE-2010-0926) is that wide links are disabled. However, smbd ensures that it isn't following symlinks by calling lstat() on every path component. This is racy, as any of the path components - either one of the directories or the file at the end - could be replaced with a symlink by an attacker over a second connection to the same share. For example, replacing a/b/c/d/e/f/g/h/i/j with a symlink to /etc/shadow would allow an attacker to read the shadow file.