Every CVE Search/ Get API key

CVE-2026-3238

Samba: denial of service against ad dc wins server

7.5 HighFix available

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.67%Up 2.6 points since Jun 8, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Samba: denial of service against ad dc wins server

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

Record
CVE-2026-3238
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476, CWE-476
Updated
2026-11-02
EUVDEUVD-2026-35033 7.5

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

Record
EUVD-2026-35033
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-gpff-px68-36rh 7.5

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain...

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

Record
GHSA-gpff-px68-36rh
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 7.5

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

Record
CVE-2026-3238
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2026-3238 7.5

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

Record
ALPINE-CVE-2026-3238
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-3238 7.5

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

Record
DEBIAN-CVE-2026-3238
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 22 moreShow less
OSVOESA-2026-2574 9.0

samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)

['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will…

Record
OESA-2026-2574
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2575 9.0

samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)

['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will…

Record
OESA-2026-2575
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2576 9.0

samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)

['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will…

Record
OESA-2026-2576
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2577 9.0

samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will probably be ignored. All bug reports should\nbe filed under the Samba 4.1 and newer product in the project's Bugzilla\ndatabase (", ').\n\n\n======================================================================\n== Our Code, Our Bugs, Our Responsibility.\n== The Samba Team\n======================================================================\n\n\n\n================\nDownload Details\n================\n\nThe uncompressed tarballs and patch files have been signed\nusing GnuPG (ID…

Record
OESA-2026-2577
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-3238 7.5

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

Record
UBUNTU-CVE-2026-3238
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-89519 No score

CVE-2026-3238 affecting package samba 4.18.3-2

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

Record
AZL-89519
Updated
2026-11-05
OSVCLSA-2026-1782159797 No score

Fix CVE(s): CVE-2026-3238

  • CVE-2026-3238: source4 WINS server NULL pointer dereference in nbtd_winsserver_register/query/release(); craft NBT packets with qdcount=0, arcount=0, or empty netbios addresses crash the nbt process on servers running wins support = yes (typical AD DC role). Fix dissolves direct variable initialization and adds NBTD_ASSERT_PACKET qdcount/arcount/length validation before any packet array dereference.
    • debian/patches/CVE-2026-3238.patch
    • CVE-2026-3238
Record
CLSA-2026-1782159797
Updated
2026-11-02
OSVopenSUSE-SU-2026:10884-1 No score

ctdb-4.23.8+git.477.f78166bceed-1.1 on GA media

These are all security issues fixed in the ctdb-4.23.8+git.477.f78166bceed-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10884-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20905-1 No score

Security update for samba

This update for samba fixes the following issues

Security issues:

  • CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
  • CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
  • CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
  • CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
  • CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
  • CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Changes for samba:

  • network:samba:STABLE/samba: "use-kerberos=desired" broken / Dolphin requires login for Samba shares (bsc#1255755).
  • Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
  • samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
  • VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
  • Updated to 4.22.9
Record
openSUSE-SU-2026:20905-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21540-1 No score

Security update for samba

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

  • CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
  • CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
  • CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
  • CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
  • CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
  • CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
  • CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
  • CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
  • CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
  • CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
  • CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
  • CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
  • CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

  • samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
  • Add python3-cryptography and python3-requests requirements for samba-python3.
Record
openSUSE-SU-2026:21540-1
Updated
2026-11-02
OSVSUSE-SU-2026:2071-1 No score

Security update for samba

This update for samba fixes the following issues

  • CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
  • CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
  • CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
  • CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).
Record
SUSE-SU-2026:2071-1
Updated
2026-11-02
OSVSUSE-SU-2026:2072-1 No score

Security update for samba

This update for samba fixes the following issues

  • CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
  • CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
  • CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
  • CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
  • CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).
Record
SUSE-SU-2026:2072-1
Updated
2026-11-02
OSVSUSE-SU-2026:2073-1 No score

Security update for samba

This update for samba fixes the following issues

  • CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
  • CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
  • CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
  • CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).
Record
SUSE-SU-2026:2073-1
Updated
2026-11-02
OSVSUSE-SU-2026:2074-1 No score

Security update for samba

This update for samba fixes the following issues

  • CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
  • CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
  • CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
  • CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
  • CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).
Record
SUSE-SU-2026:2074-1
Updated
2026-11-02
OSVSUSE-SU-2026:2076-1 No score

Security update for samba

This update for samba fixes the following issues

Security issues:

  • CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
  • CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
  • CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
  • CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
  • CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
  • CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Non security issue:

  • network:samba:STABLE/samba: 'use-kerberos=desired' broken / Dolphin requires login for Samba shares (bsc#1255755).
  • Generated dynamic profile based on path to special 'printers' share. (bsc#1259441).
  • Fix regression 'use-kerberos=desired' broken doesn't even try to authenticate with kerberos and instead fallsback to NTLM (bsc#1255755).
  • Fix memory leak using cups parsed options and filename allocated when processing end of printing job (bsc#1257200).
  • Fix manpage for 'net offlinejoin requestodj'.
  • Fix 'ctdbd socket' documentation in manpage for smb.conf
  • Fix rpc workers with long living clients from growing server memory keytab and increasing memory used by workers (bsc#1257200).
Record
SUSE-SU-2026:2076-1
Updated
2026-11-02
OSVSUSE-SU-2026:2108-1 No score

Security update for samba

This update for samba fixes the following issues

  • CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
  • CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
  • CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
  • CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Non security issues:

  • Fix pthreadpool_tevent race conditions accessing both pthreadpool_tevent.jobs list and pthreadpool_tevent.glue_list (bsc#1252963)
Record
SUSE-SU-2026:2108-1
Updated
2026-11-02
OSVSUSE-SU-2026:22045-1 No score

Security update for samba

This update for samba fixes the following issues

Security issues:

  • CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
  • CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
  • CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
  • CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
  • CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
  • CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Changes for samba:

  • network:samba:STABLE/samba: "use-kerberos=desired" broken / Dolphin requires login for Samba shares (bsc#1255755).
  • Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
  • samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
  • VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
  • Updated to 4.22.9
Record
SUSE-SU-2026:22045-1
Updated
2026-11-02
OSVSUSE-SU-2026:22080-1 No score

Security update for samba

This update for samba fixes the following issues

Security issues:

  • CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
  • CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
  • CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
  • CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
  • CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
  • CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Changes for samba:

  • network:samba:STABLE/samba: "use-kerberos=desired" broken / Dolphin requires login for Samba shares (bsc#1255755).
  • Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
  • samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
  • VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
  • Updated to 4.22.9
Record
SUSE-SU-2026:22080-1
Updated
2026-11-02
OSVSUSE-SU-2026:23003-1 No score

Security update for samba

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

  • CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
  • CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
  • CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
  • CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
  • CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
  • CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
  • CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
  • CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
  • CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
  • CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
  • CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
  • CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
  • CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

  • samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
  • Add python3-cryptography and python3-requests requirements for samba-python3.
Record
SUSE-SU-2026:23003-1
Updated
2026-11-02
OSVSUSE-SU-2026:23129-1 No score

Security update for samba

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

  • CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
  • CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
  • CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
  • CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
  • CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
  • CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
  • CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
  • CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
  • CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
  • CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
  • CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
  • CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
  • CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

  • samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
  • Add python3-cryptography and python3-requests requirements for samba-python3.
Record
SUSE-SU-2026:23129-1
Updated
2026-11-02
OSVSUSE-SU-2026:23152-1 No score

Security update for samba

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

  • CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
  • CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
  • CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
  • CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
  • CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
  • CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
  • CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
  • CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
  • CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
  • CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
  • CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
  • CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
  • CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

  • samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
  • Add python3-cryptography and python3-requests requirements for samba-python3.
Record
SUSE-SU-2026:23152-1
Updated
2026-11-02
OSVUSN-8306-2 No score

samba vulnerabilities

USN-8306-1 fixed vulnerabilities in Samba. This update provides the corresponding updates for CVE-2026-3238, CVE-2026-4408, and CVE-2026-4480 in Ubuntu 20.04 LTS.

Original advisory details:

Asim Viladi Oglu Manizada discovered that Samba incorrectly handled access checks on reparse point operations. An attacker could possibly use this issue to modify reparse point extended attributes on files that should have been read-only. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-1933)

Pavel Kohout discovered that Samba's vfs_worm module did not properly block file overwrites. An attacker could possibly use this issue to overwrite files that should have remained immutable. (CVE-2026-2340)

Arad Inbar, Nir Somech, and Ben Grinberg discovered that Samba incorrectly handled certificate auto-enrolment group policies over HTTP without verification. A machine-in-the-middle attacker could possibly use this issue to install a malicious CA certificate. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-3012)

Arad Inbar, Erez Cohen, Nir Somech, and Ben Grinberg discovered that Samba's Active Directory Domain Controller WINS server could be made to crash under certain circumstances. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-3238)

Ron Ben Yizhak discovered that Samba's DCE/RPC SAMR server incorrectly handled a non-default password check script configuration. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-4408)

Ron Ben Yizhak discovered that Samba's printing subsystem incorrectly handled a non-default print command configuration. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-4480)

Record
USN-8306-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
samba
Alpine:v3.23
 before 4.22.10-r0
4.22.10-r0
samba
Alpine:v3.24
 before 4.23.8-r0
4.23.8-r0
samba
Azure Linux:3
 through 4.18.3-2 None known
ctdb
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
libnss-winbind
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
libpam-winbind
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
libsmbclient
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
libsmbclient-dev
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
libwbclient-dev
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
libwbclient0
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
Show 37 moreShow less
Affected packages
PackageAffectedFixed
python3-samba
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
registry-tools
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
samba
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
samba-common
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
samba-common-bin
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
samba-dev
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
samba-dsdb-modules
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
samba-libs
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
samba-testsuite
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
samba-vfs-modules
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
smbclient
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
winbind
TuxCare:Ubuntu:20.04
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
2:4.15.13+dfsg-0ubuntu0.20.04.8+tuxcare.els5
samba
Debian:12
 before 2:4.17.12+dfsg-0+deb12u4, plus listed versions
2:4.17.10+dfsg-0+deb12u12:4.17.10+dfsg-0+deb12u1~bpo11+12:4.17.11+dfsg-0+deb12u12:4.17.12+dfsg-0+deb12u12:4.17.12+dfsg-0+deb12u1~bpo11+1
Show 8 moreShow less
2:4.17.12+dfsg-0+deb12u22:4.17.12+dfsg-0+deb12u32:4.17.8+dfsg-22:4.17.8+dfsg-2.12:4.17.9+dfsg-0+deb12u12:4.17.9+dfsg-0+deb12u22:4.17.9+dfsg-0+deb12u32:4.17.9+dfsg-0+deb12u3~bpo11+1
2:4.17.12+dfsg-0+deb12u4
samba
Debian:13
 before 2:4.22.8+dfsg-0+deb13u2, plus listed versions
2:4.22.3+dfsg-42:4.22.4+dfsg-12:4.22.4+dfsg-1~deb13u12:4.22.4+dfsg-1~deb13u1~bpo12+12:4.22.6+dfsg-0+deb13u12:4.22.6+dfsg-0+deb13u1~bpo12+12:4.22.8+dfsg-0+deb13u1
2:4.22.8+dfsg-0+deb13u2
samba
Debian:14
 before 2:4.24.3+dfsg-1, plus listed versions
2:4.22.3+dfsg-42:4.22.4+dfsg-12:4.22.4+dfsg-1~deb13u12:4.22.4+dfsg-1~deb13u1~bpo12+12:4.23.0+dfsg-1
Show 25 moreShow less
2:4.23.0+dfsg-22:4.23.0+dfsg-32:4.23.0~rc1+dfsg-12:4.23.0~rc2+dfsg-12:4.23.0~rc3+dfsg-12:4.23.1+dfsg-12:4.23.2+dfsg-12:4.23.3+dfsg-12:4.23.3+dfsg-1~bpo13+12:4.23.4+dfsg-12:4.23.4+dfsg-1~bpo13+12:4.23.5+dfsg-12:4.23.5+dfsg-1~bpo13+12:4.23.6+dfsg-12:4.23.6+dfsg-22:4.23.6+dfsg-2~bpo13+12:4.24.0+dfsg-12:4.24.0~rc1+dfsg-12:4.24.0~rc1+dfsg-22:4.24.0~rc1+dfsg-32:4.24.0~rc2+dfsg-12:4.24.1+dfsg-12:4.24.2+dfsg-12:4.24.2+dfsg-1~bpo13+12:4.24.3+dfsg-1~bpo13+1
2:4.24.3+dfsg-1
samba
openEuler:22.03-LTS-SP4
From an advisory covering 4 CVEs
 before 4.17.5-15.oe2203sp4
4.17.5-15.oe2203sp4
samba
openEuler:24.03-LTS-SP1
From an advisory covering 4 CVEs
 before 4.19.3-9.oe2403sp1
4.19.3-9.oe2403sp1
samba
openEuler:24.03-LTS-SP3
From an advisory covering 4 CVEs
 before 4.19.3-9.oe2403sp3
4.19.3-9.oe2403sp3
samba
openEuler:20.03-LTS-SP4
From an advisory covering 3 CVEs
 before 4.11.12-38.oe2003sp4
4.11.12-38.oe2003sp4
samba
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 4.22.9+git.506.22c03ce0781-160000.1.1
4.22.9+git.506.22c03ce0781-160000.1.1
samba
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 4.22.9+git.506.22c03ce0781-160000.1.1
4.22.9+git.506.22c03ce0781-160000.1.1
samba
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 4.22.9+git.506.22c03ce0781-160000.1.1
4.22.9+git.506.22c03ce0781-160000.1.1
samba
SUSE:Linux Micro 6.2
From an advisory covering 13 CVEs
 before 4.22.11+git.552.66cfeb7de0a-160000.1.1
4.22.11+git.552.66cfeb7de0a-160000.1.1
samba
SUSE:Linux Enterprise Server 16.0
From an advisory covering 13 CVEs
 before 4.22.11+git.552.66cfeb7de0a-160000.1.1
4.22.11+git.552.66cfeb7de0a-160000.1.1
samba
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 13 CVEs
 before 4.22.11+git.552.66cfeb7de0a-160000.1.1
4.22.11+git.552.66cfeb7de0a-160000.1.1
samba
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2:3.6.18-1ubuntu32:4.0.10+dfsg-4ubuntu22:4.0.13+dfsg-1ubuntu12:4.1.3+dfsg-2ubuntu22:4.1.3+dfsg-2ubuntu3
Show 45 moreShow less
2:4.1.3+dfsg-2ubuntu42:4.1.3+dfsg-2ubuntu52:4.1.6+dfsg-1ubuntu12:4.1.6+dfsg-1ubuntu22:4.1.6+dfsg-1ubuntu2.14.04.12:4.1.6+dfsg-1ubuntu2.14.04.22:4.1.6+dfsg-1ubuntu2.14.04.32:4.1.6+dfsg-1ubuntu2.14.04.42:4.1.6+dfsg-1ubuntu2.14.04.52:4.1.6+dfsg-1ubuntu2.14.04.72:4.1.6+dfsg-1ubuntu2.14.04.82:4.1.6+dfsg-1ubuntu2.14.04.92:4.1.6+dfsg-1ubuntu2.14.04.112:4.1.6+dfsg-1ubuntu2.14.04.122:4.1.6+dfsg-1ubuntu2.14.04.132:4.3.8+dfsg-0ubuntu0.14.04.22:4.3.9+dfsg-0ubuntu0.14.04.12:4.3.9+dfsg-0ubuntu0.14.04.32:4.3.11+dfsg-0ubuntu0.14.04.12:4.3.11+dfsg-0ubuntu0.14.04.22:4.3.11+dfsg-0ubuntu0.14.04.32:4.3.11+dfsg-0ubuntu0.14.04.42:4.3.11+dfsg-0ubuntu0.14.04.62:4.3.11+dfsg-0ubuntu0.14.04.72:4.3.11+dfsg-0ubuntu0.14.04.82:4.3.11+dfsg-0ubuntu0.14.04.92:4.3.11+dfsg-0ubuntu0.14.04.102:4.3.11+dfsg-0ubuntu0.14.04.112:4.3.11+dfsg-0ubuntu0.14.04.122:4.3.11+dfsg-0ubuntu0.14.04.132:4.3.11+dfsg-0ubuntu0.14.04.142:4.3.11+dfsg-0ubuntu0.14.04.162:4.3.11+dfsg-0ubuntu0.14.04.172:4.3.11+dfsg-0ubuntu0.14.04.192:4.3.11+dfsg-0ubuntu0.14.04.202:4.3.11+dfsg-0ubuntu0.14.04.20+esm12:4.3.11+dfsg-0ubuntu0.14.04.20+esm22:4.3.11+dfsg-0ubuntu0.14.04.20+esm32:4.3.11+dfsg-0ubuntu0.14.04.20+esm42:4.3.11+dfsg-0ubuntu0.14.04.20+esm62:4.3.11+dfsg-0ubuntu0.14.04.20+esm72:4.3.11+dfsg-0ubuntu0.14.04.20+esm82:4.3.11+dfsg-0ubuntu0.14.04.20+esm92:4.3.11+dfsg-0ubuntu0.14.04.20+esm112:4.3.11+dfsg-0ubuntu0.14.04.20+esm12
 None known
samba
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:4.1.17+dfsg-4ubuntu22:4.1.20+dfsg-1ubuntu12:4.1.20+dfsg-1ubuntu22:4.1.20+dfsg-1ubuntu32:4.1.20+dfsg-1ubuntu5
Show 41 moreShow less
2:4.3.3+dfsg-1ubuntu12:4.3.3+dfsg-1ubuntu22:4.3.3+dfsg-1ubuntu32:4.3.6+dfsg-1ubuntu12:4.3.8+dfsg-0ubuntu12:4.3.9+dfsg-0ubuntu0.16.04.12:4.3.9+dfsg-0ubuntu0.16.04.22:4.3.9+dfsg-0ubuntu0.16.04.32:4.3.11+dfsg-0ubuntu0.16.04.12:4.3.11+dfsg-0ubuntu0.16.04.32:4.3.11+dfsg-0ubuntu0.16.04.52:4.3.11+dfsg-0ubuntu0.16.04.62:4.3.11+dfsg-0ubuntu0.16.04.72:4.3.11+dfsg-0ubuntu0.16.04.82:4.3.11+dfsg-0ubuntu0.16.04.92:4.3.11+dfsg-0ubuntu0.16.04.102:4.3.11+dfsg-0ubuntu0.16.04.112:4.3.11+dfsg-0ubuntu0.16.04.122:4.3.11+dfsg-0ubuntu0.16.04.132:4.3.11+dfsg-0ubuntu0.16.04.152:4.3.11+dfsg-0ubuntu0.16.04.162:4.3.11+dfsg-0ubuntu0.16.04.172:4.3.11+dfsg-0ubuntu0.16.04.182:4.3.11+dfsg-0ubuntu0.16.04.192:4.3.11+dfsg-0ubuntu0.16.04.202:4.3.11+dfsg-0ubuntu0.16.04.212:4.3.11+dfsg-0ubuntu0.16.04.232:4.3.11+dfsg-0ubuntu0.16.04.242:4.3.11+dfsg-0ubuntu0.16.04.252:4.3.11+dfsg-0ubuntu0.16.04.262:4.3.11+dfsg-0ubuntu0.16.04.272:4.3.11+dfsg-0ubuntu0.16.04.282:4.3.11+dfsg-0ubuntu0.16.04.292:4.3.11+dfsg-0ubuntu0.16.04.302:4.3.11+dfsg-0ubuntu0.16.04.312:4.3.11+dfsg-0ubuntu0.16.04.322:4.3.11+dfsg-0ubuntu0.16.04.342:4.3.11+dfsg-0ubuntu0.16.04.34+esm12:4.3.11+dfsg-0ubuntu0.16.04.34+esm22:4.3.11+dfsg-0ubuntu0.16.04.34+esm32:4.3.11+dfsg-0ubuntu0.16.04.34+esm4
 None known
samba
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:4.6.7+dfsg-1ubuntu32:4.7.1+dfsg-1ubuntu12:4.7.3+dfsg-1ubuntu12:4.7.4+dfsg-1ubuntu12:4.7.6+dfsg~ubuntu-0ubuntu1
Show 27 moreShow less
2:4.7.6+dfsg~ubuntu-0ubuntu22:4.7.6+dfsg~ubuntu-0ubuntu2.22:4.7.6+dfsg~ubuntu-0ubuntu2.42:4.7.6+dfsg~ubuntu-0ubuntu2.52:4.7.6+dfsg~ubuntu-0ubuntu2.62:4.7.6+dfsg~ubuntu-0ubuntu2.72:4.7.6+dfsg~ubuntu-0ubuntu2.92:4.7.6+dfsg~ubuntu-0ubuntu2.102:4.7.6+dfsg~ubuntu-0ubuntu2.112:4.7.6+dfsg~ubuntu-0ubuntu2.132:4.7.6+dfsg~ubuntu-0ubuntu2.142:4.7.6+dfsg~ubuntu-0ubuntu2.152:4.7.6+dfsg~ubuntu-0ubuntu2.162:4.7.6+dfsg~ubuntu-0ubuntu2.172:4.7.6+dfsg~ubuntu-0ubuntu2.182:4.7.6+dfsg~ubuntu-0ubuntu2.192:4.7.6+dfsg~ubuntu-0ubuntu2.202:4.7.6+dfsg~ubuntu-0ubuntu2.212:4.7.6+dfsg~ubuntu-0ubuntu2.232:4.7.6+dfsg~ubuntu-0ubuntu2.242:4.7.6+dfsg~ubuntu-0ubuntu2.262:4.7.6+dfsg~ubuntu-0ubuntu2.272:4.7.6+dfsg~ubuntu-0ubuntu2.282:4.7.6+dfsg~ubuntu-0ubuntu2.292:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm12:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm22:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm3
 None known
samba
Ubuntu:Pro:20.04:LTS
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+esm2, plus listed versions
2:4.10.7+dfsg-0ubuntu22:4.10.7+dfsg-0ubuntu32:4.11.1+dfsg-3ubuntu12:4.11.1+dfsg-3ubuntu22:4.11.1+dfsg-3ubuntu4
Show 31 moreShow less
2:4.11.5+dfsg-1ubuntu12:4.11.5+dfsg-1ubuntu22:4.11.6+dfsg-0ubuntu12:4.11.6+dfsg-0ubuntu1.12:4.11.6+dfsg-0ubuntu1.22:4.11.6+dfsg-0ubuntu1.32:4.11.6+dfsg-0ubuntu1.42:4.11.6+dfsg-0ubuntu1.52:4.11.6+dfsg-0ubuntu1.62:4.11.6+dfsg-0ubuntu1.82:4.11.6+dfsg-0ubuntu1.92:4.11.6+dfsg-0ubuntu1.102:4.13.14+dfsg-0ubuntu0.20.04.12:4.13.14+dfsg-0ubuntu0.20.04.22:4.13.14+dfsg-0ubuntu0.20.04.32:4.13.14+dfsg-0ubuntu0.20.04.42:4.13.17~dfsg-0ubuntu0.21.04.12:4.13.17~dfsg-0ubuntu0.21.04.22:4.13.17~dfsg-0ubuntu1.20.04.12:4.13.17~dfsg-0ubuntu1.20.04.22:4.13.17~dfsg-0ubuntu1.20.04.42:4.13.17~dfsg-0ubuntu1.20.04.52:4.15.13+dfsg-0ubuntu0.20.04.12:4.15.13+dfsg-0ubuntu0.20.04.22:4.15.13+dfsg-0ubuntu0.20.04.32:4.15.13+dfsg-0ubuntu0.20.04.42:4.15.13+dfsg-0ubuntu0.20.04.52:4.15.13+dfsg-0ubuntu0.20.04.62:4.15.13+dfsg-0ubuntu0.20.04.72:4.15.13+dfsg-0ubuntu0.20.04.82:4.15.13+dfsg-0ubuntu0.20.04.8+esm1
2:4.15.13+dfsg-0ubuntu0.20.04.8+esm2
samba
Ubuntu:22.04:LTS
 before 2:4.15.13+dfsg-0ubuntu1.12, plus listed versions
2:4.13.5+dfsg-2ubuntu22:4.13.5+dfsg-2ubuntu32:4.13.14+dfsg-0ubuntu12:4.13.14+dfsg-0ubuntu22:4.15.5~dfsg-0ubuntu1
Show 17 moreShow less
2:4.15.5~dfsg-0ubuntu22:4.15.5~dfsg-0ubuntu42:4.15.5~dfsg-0ubuntu52:4.15.5~dfsg-0ubuntu5.12:4.15.9+dfsg-0ubuntu0.22:4.15.9+dfsg-0ubuntu0.32:4.15.13+dfsg-0ubuntu12:4.15.13+dfsg-0ubuntu1.12:4.15.13+dfsg-0ubuntu1.22:4.15.13+dfsg-0ubuntu1.32:4.15.13+dfsg-0ubuntu1.42:4.15.13+dfsg-0ubuntu1.52:4.15.13+dfsg-0ubuntu1.62:4.15.13+dfsg-0ubuntu1.72:4.15.13+dfsg-0ubuntu1.82:4.15.13+dfsg-0ubuntu1.92:4.15.13+dfsg-0ubuntu1.10
2:4.15.13+dfsg-0ubuntu1.12
samba
Ubuntu:24.04:LTS
 before 2:4.19.5+dfsg-4ubuntu9.6, plus listed versions
2:4.18.6+dfsg-1ubuntu22:4.18.6+dfsg-1ubuntu2.12:4.18.6+dfsg-1ubuntu2.22:4.19.4+dfsg-3ubuntu12:4.19.5+dfsg-1ubuntu1
Show 6 moreShow less
2:4.19.5+dfsg-4ubuntu72:4.19.5+dfsg-4ubuntu82:4.19.5+dfsg-4ubuntu92:4.19.5+dfsg-4ubuntu9.22:4.19.5+dfsg-4ubuntu9.32:4.19.5+dfsg-4ubuntu9.4
2:4.19.5+dfsg-4ubuntu9.6
samba
Ubuntu:25.10
 before 2:4.22.3+dfsg-4ubuntu2.4, plus listed versions
2:4.21.4+dfsg-1ubuntu32:4.21.4+dfsg-1ubuntu42:4.21.4+dfsg-1ubuntu52:4.22.2+dfsg-1ubuntu12:4.22.3+dfsg-4ubuntu12:4.22.3+dfsg-4ubuntu22:4.22.3+dfsg-4ubuntu2.12:4.22.3+dfsg-4ubuntu2.2
2:4.22.3+dfsg-4ubuntu2.4
samba
Ubuntu:26.04:LTS
 before 2:4.23.6+dfsg-1ubuntu2.1, plus listed versions
2:4.22.3+dfsg-4ubuntu22:4.22.3+dfsg-4ubuntu2.12:4.22.3+dfsg-4ubuntu32:4.22.3+dfsg-4ubuntu42:4.23.4+dfsg-1ubuntu12:4.23.5+dfsg-1ubuntu22:4.23.6+dfsg-1ubuntu12:4.23.6+dfsg-1ubuntu2
2:4.23.6+dfsg-1ubuntu2.1
samba
Ubuntu:Pro:20.04:LTS
From an advisory covering 3 CVEs
 before 2:4.15.13+dfsg-0ubuntu0.20.04.8+esm2, plus listed versions
2:4.10.7+dfsg-0ubuntu22:4.10.7+dfsg-0ubuntu32:4.11.1+dfsg-3ubuntu12:4.11.1+dfsg-3ubuntu22:4.11.1+dfsg-3ubuntu4
Show 31 moreShow less
2:4.11.5+dfsg-1ubuntu12:4.11.5+dfsg-1ubuntu22:4.11.6+dfsg-0ubuntu12:4.11.6+dfsg-0ubuntu1.12:4.11.6+dfsg-0ubuntu1.22:4.11.6+dfsg-0ubuntu1.32:4.11.6+dfsg-0ubuntu1.42:4.11.6+dfsg-0ubuntu1.52:4.11.6+dfsg-0ubuntu1.62:4.11.6+dfsg-0ubuntu1.82:4.11.6+dfsg-0ubuntu1.92:4.11.6+dfsg-0ubuntu1.102:4.13.14+dfsg-0ubuntu0.20.04.12:4.13.14+dfsg-0ubuntu0.20.04.22:4.13.14+dfsg-0ubuntu0.20.04.32:4.13.14+dfsg-0ubuntu0.20.04.42:4.13.17~dfsg-0ubuntu0.21.04.12:4.13.17~dfsg-0ubuntu0.21.04.22:4.13.17~dfsg-0ubuntu1.20.04.12:4.13.17~dfsg-0ubuntu1.20.04.22:4.13.17~dfsg-0ubuntu1.20.04.42:4.13.17~dfsg-0ubuntu1.20.04.52:4.15.13+dfsg-0ubuntu0.20.04.12:4.15.13+dfsg-0ubuntu0.20.04.22:4.15.13+dfsg-0ubuntu0.20.04.32:4.15.13+dfsg-0ubuntu0.20.04.42:4.15.13+dfsg-0ubuntu0.20.04.52:4.15.13+dfsg-0ubuntu0.20.04.62:4.15.13+dfsg-0ubuntu0.20.04.72:4.15.13+dfsg-0ubuntu0.20.04.82:4.15.13+dfsg-0ubuntu0.20.04.8+esm1
2:4.15.13+dfsg-0ubuntu0.20.04.8+esm2
samba
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 4.23.8+git.477.f78166bceed-1.1
4.23.8+git.477.f78166bceed-1.1
samba
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 4.22.9+git.506.22c03ce0781-160000.1.1
4.22.9+git.506.22c03ce0781-160000.1.1
samba
openSUSE:Leap 16.0
From an advisory covering 13 CVEs
 before 4.22.11+git.552.66cfeb7de0a-160000.1.1
4.22.11+git.552.66cfeb7de0a-160000.1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-3238 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published May 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.67%, the 85th percentile. Fixed in samba 4.22.10-r0.

References

Show 62 moreShow less
This page doesn't list everything

Left out here: 3 versions and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open