CVE-2026-4480

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)

['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will…

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)

['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will…

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)

['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will…

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will probably be ignored. All bug reports should\nbe filed under the Samba 4.1 and newer product in the project's Bugzilla\ndatabase (", ').\n\n\n======================================================================\n== Our Code, Our Bugs, Our Responsibility.\n== The Samba Team\n======================================================================\n\n\n\n================\nDownload Details\n================\n\nThe uncompressed tarballs and patch files have been signed\nusing GnuPG (ID…

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Missing access check on reparse point operations (CVE-2026-1933)

• samba: vfs_worm does not block directory modification (CVE-2026-2340)

• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

• ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)

• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Missing access check on reparse point operations (CVE-2026-1933)

• samba: vfs_worm does not block directory modification (CVE-2026-2340)

• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

• ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)

• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Missing access check on reparse point operations (CVE-2026-1933)
• samba: vfs_worm does not block directory modification (CVE-2026-2340)
• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
• ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Missing access check on reparse point operations (CVE-2026-1933)
• samba: vfs_worm does not block directory modification (CVE-2026-2340)
• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
• ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.

• CVE-2026-4480: escape shell metacharacters in the client-controlled print job name before substituting it into "print command" via %J, preventing remote command injection in the printing subsystem.

• CVE-2026-4480: escape shell metacharacters in the client-controlled print job name before substituting it into "print command" via %J, preventing remote command injection in the printing subsystem.

• CVE-2026-4480: escape shell metacharacters in the client-controlled print job name before substituting it into "print command" via %J, preventing remote command injection in the printing subsystem.

• CVE-2026-4480: fix unauthenticated RCE in the printing %J substitution by masking shell-unsafe characters in the client-supplied job name

• CVE-2026-4480: fix unauthenticated RCE in the printing %J substitution by masking shell-unsafe characters in the client-supplied job name

• CVE-2026-4480: fix unauthenticated RCE in the printing %J substitution by masking shell-unsafe characters in the client-supplied job name

• Rebase onto RHEL samba-4.14.5-9.el8_5: CVE-2021-44142, the CVE-2020-25717 username map script regression, the domain-join segfault and the dangling symlink directory deletion fixes are now provided by the base.
• Re-apply TuxCare ELS security backports on the new base:
• CVE-2022-32742: fix server memory information leak via SMB1
• CVE-2022-38023: avoid weak rc4-hmac encryption algorithm for the Netlogon RPC
• CVE-2022-1615: util/genrand: don't ignore errors in random number generation
• CVE-2022-2127: fix out-of-bounds read triggered by a malicious request
• CVE-2023-34966: fix infinite loop vulnerability in mdssvc RPC service
• CVE-2023-3961: fix a path traversal out of the socket directory
• CVE-2023-4091: fix file truncation issue in acl_xattr module
• CVE-2023-34967: fix type confusion vulnerability in mdssvc RPC service
• CVE-2023-34968: fix path disclosure vulnerability in mdssvc
• CVE-2023-42669: disable the rpcecho server
• CVE-2026-4480: escape shell metacharacters in the client-controlled print job name before substituting it into "print command" via %J

• CVE-2026-4480: mask and single-quote jobname passed as %J to 'print command' to prevent remote command injection via the generic print pipeline

• SECURITY UPDATE: pre-authentication remote code execution in the printing subsystem via unescaped %J substitution in 'print command'. The client-controlled job name was passed to the shell with only a single quote -> underscore transformation, allowing shell metacharacters to inject arbitrary commands when 'printing' is set to a non-CUPS backend (sysv, lprng, bsd, plp, aix, hpux, qnx, softq).
  • debian/patches/CVE-2026-4480.patch
  • CVE-2026-4480

These are all security issues fixed in the ctdb-4.23.8+git.477.f78166bceed-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues

Security issues:

• CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Changes for samba:

• network:samba:STABLE/samba: "use-kerberos=desired" broken / Dolphin requires login for Samba shares (bsc#1255755).
• Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
• samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
• VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
• Updated to 4.22.9

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

• CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
• CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
• CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
• CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
• CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
• CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
• CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
• CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
• CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
• CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
• CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
• CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
• CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

• samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
• Add python3-cryptography and python3-requests requirements for samba-python3.

This update for samba fixes the following issues

• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

This update for samba fixes the following issues

• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

This update for samba fixes the following issues

• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

This update for samba fixes the following issues

• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

This update for samba fixes the following issues

Security issues:

• CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Non security issue:

• network:samba:STABLE/samba: 'use-kerberos=desired' broken / Dolphin requires login for Samba shares (bsc#1255755).
• Generated dynamic profile based on path to special 'printers' share. (bsc#1259441).
• Fix regression 'use-kerberos=desired' broken doesn't even try to authenticate with kerberos and instead fallsback to NTLM (bsc#1255755).
• Fix memory leak using cups parsed options and filename allocated when processing end of printing job (bsc#1257200).
• Fix manpage for 'net offlinejoin requestodj'.
• Fix 'ctdbd socket' documentation in manpage for smb.conf
• Fix rpc workers with long living clients from growing server memory keytab and increasing memory used by workers (bsc#1257200).

This update for samba fixes the following issues

• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Non security issues:

• Fix pthreadpool_tevent race conditions accessing both pthreadpool_tevent.jobs list and pthreadpool_tevent.glue_list (bsc#1252963)

This update for samba fixes the following issues

Security issues:

• CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Changes for samba:

• network:samba:STABLE/samba: "use-kerberos=desired" broken / Dolphin requires login for Samba shares (bsc#1255755).
• Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
• samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
• VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
• Updated to 4.22.9

This update for samba fixes the following issues

Security issues:

• CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Changes for samba:

• network:samba:STABLE/samba: "use-kerberos=desired" broken / Dolphin requires login for Samba shares (bsc#1255755).
• Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
• samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
• VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
• Updated to 4.22.9

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

• CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
• CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
• CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
• CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
• CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
• CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
• CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
• CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
• CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
• CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
• CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
• CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
• CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

• samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
• Add python3-cryptography and python3-requests requirements for samba-python3.

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

• CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
• CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
• CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
• CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
• CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
• CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
• CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
• CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
• CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
• CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
• CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
• CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
• CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

• samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
• Add python3-cryptography and python3-requests requirements for samba-python3.

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

• CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
• CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
• CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
• CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
• CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
• CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
• CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
• CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
• CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
• CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
• CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
• CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
• CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

• samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
• Add python3-cryptography and python3-requests requirements for samba-python3.

USN-8306-1 fixed vulnerabilities in Samba. This update provides the corresponding updates for CVE-2026-3238, CVE-2026-4408, and CVE-2026-4480 in Ubuntu 20.04 LTS.

Original advisory details:

Asim Viladi Oglu Manizada discovered that Samba incorrectly handled access checks on reparse point operations. An attacker could possibly use this issue to modify reparse point extended attributes on files that should have been read-only. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-1933)

Pavel Kohout discovered that Samba's vfs_worm module did not properly block file overwrites. An attacker could possibly use this issue to overwrite files that should have remained immutable. (CVE-2026-2340)

Arad Inbar, Nir Somech, and Ben Grinberg discovered that Samba incorrectly handled certificate auto-enrolment group policies over HTTP without verification. A machine-in-the-middle attacker could possibly use this issue to install a malicious CA certificate. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-3012)

Arad Inbar, Erez Cohen, Nir Somech, and Ben Grinberg discovered that Samba's Active Directory Domain Controller WINS server could be made to crash under certain circumstances. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-3238)

Ron Ben Yizhak discovered that Samba's DCE/RPC SAMR server incorrectly handled a non-default password check script configuration. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-4408)

Ron Ben Yizhak discovered that Samba's printing subsystem incorrectly handled a non-default print command configuration. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-4480)