CVE-2026-1933

A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Missing access check on reparse point operations (CVE-2026-1933)

• samba: vfs_worm does not block directory modification (CVE-2026-2340)

• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

• ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)

• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Missing access check on reparse point operations (CVE-2026-1933)

• samba: vfs_worm does not block directory modification (CVE-2026-2340)

• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

• ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)

• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Missing access check on reparse point operations (CVE-2026-1933)
• samba: vfs_worm does not block directory modification (CVE-2026-2340)
• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
• ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Missing access check on reparse point operations (CVE-2026-1933)
• samba: vfs_worm does not block directory modification (CVE-2026-2340)
• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
• ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-1933: add missing SMB-layer access checks to reparse point set/delete operations, preventing authenticated users from modifying reparse point metadata on read-only shares and read-only file handles

These are all security issues fixed in the ctdb-4.23.8+git.477.f78166bceed-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues

Security issues:

• CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Changes for samba:

• network:samba:STABLE/samba: "use-kerberos=desired" broken / Dolphin requires login for Samba shares (bsc#1255755).
• Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
• samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
• VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
• Updated to 4.22.9

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

• CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
• CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
• CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
• CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
• CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
• CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
• CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
• CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
• CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
• CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
• CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
• CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
• CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

• samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
• Add python3-cryptography and python3-requests requirements for samba-python3.

This update for samba fixes the following issues

Security issues:

• CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Non security issue:

• network:samba:STABLE/samba: 'use-kerberos=desired' broken / Dolphin requires login for Samba shares (bsc#1255755).
• Generated dynamic profile based on path to special 'printers' share. (bsc#1259441).
• Fix regression 'use-kerberos=desired' broken doesn't even try to authenticate with kerberos and instead fallsback to NTLM (bsc#1255755).
• Fix memory leak using cups parsed options and filename allocated when processing end of printing job (bsc#1257200).
• Fix manpage for 'net offlinejoin requestodj'.
• Fix 'ctdbd socket' documentation in manpage for smb.conf
• Fix rpc workers with long living clients from growing server memory keytab and increasing memory used by workers (bsc#1257200).

This update for samba fixes the following issues

Security issues:

• CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Changes for samba:

• network:samba:STABLE/samba: "use-kerberos=desired" broken / Dolphin requires login for Samba shares (bsc#1255755).
• Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
• samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
• VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
• Updated to 4.22.9

This update for samba fixes the following issues

Security issues:

• CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Changes for samba:

• network:samba:STABLE/samba: "use-kerberos=desired" broken / Dolphin requires login for Samba shares (bsc#1255755).
• Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
• samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
• VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
• Updated to 4.22.9

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

• CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
• CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
• CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
• CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
• CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
• CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
• CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
• CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
• CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
• CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
• CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
• CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
• CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

• samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
• Add python3-cryptography and python3-requests requirements for samba-python3.

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

• CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
• CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
• CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
• CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
• CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
• CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
• CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
• CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
• CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
• CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
• CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
• CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
• CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

• samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
• Add python3-cryptography and python3-requests requirements for samba-python3.

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

• CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
• CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
• CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
• CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
• CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
• CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
• CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
• CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
• CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
• CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
• CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
• CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
• CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

• samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
• Add python3-cryptography and python3-requests requirements for samba-python3.

Asim Viladi Oglu Manizada discovered that Samba incorrectly handled access checks on reparse point operations. An attacker could possibly use this issue to modify reparse point extended attributes on files that should have been read-only. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-1933)

Pavel Kohout discovered that Samba's vfs_worm module did not properly block file overwrites. An attacker could possibly use this issue to overwrite files that should have remained immutable. (CVE-2026-2340)

Arad Inbar, Nir Somech, and Ben Grinberg discovered that Samba incorrectly handled certificate auto-enrolment group policies over HTTP without verification. A machine-in-the-middle attacker could possibly use this issue to install a malicious CA certificate. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-3012)

Arad Inbar, Erez Cohen, Nir Somech, and Ben Grinberg discovered that Samba's Active Directory Domain Controller WINS server could be made to crash under certain circumstances. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-3238)

Ron Ben Yizhak discovered that Samba's DCE/RPC SAMR server incorrectly handled a non-default password check script configuration. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-4408)

Ron Ben Yizhak discovered that Samba's printing subsystem incorrectly handled a non-default print command configuration. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-4480)