CVE-2026-3012

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)

['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will…

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)

['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will…

Samba is a suite of programs for Linux and Unix to interoperate with Windows.

Security Fix(es):

A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)

['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan Metzmacher <metze () samba org>', 'Release Announcements\n---------------------\n\nThis is a security release in order to address the following defects:\n\no CVE-2026-1933: Missing access checks on reparse point operations\n\n On a share marked "read only = yes" and\n on file handles opened R/O users can set\n or delete the reparse point xattrs on files\n that the user has write-access in the file\n system for.', 'o CVE-2026-2340: WORM vfs module does not block overwrites\n\n The WORM (Write-Once, Read Many) vfs module\n is supposed to lock write access to shared\n files, so they cannot be altered after initial\n writes. It was allowing files to be overwritten\n by renaming a newly created file over a protected\n file.', 'o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http\n without verification\n\n To bootstrap a certificate chain a domain member must\n fetch a certificate without TLS. It was trusting HTTP\n for this when a more secure encrypted LDAP channel\n was also available.', 'o CVE-2026-3238: Denial of service against AD DC WINS server\n\n The WINS server component of the Active\n Directory Domain controller code in Samba\n is vulnerable to a NULL pointer dereference\n and crash caused by a unauthenticated UDP\n packet.', 'server', '"check password script" that has the %u substitution\n character are vulnerable to a remote code execution.', 'o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing\n subsystem\n\n Samba print servers with a "print command"\n that has the %J substitution character\n are vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no Douglas Bagnall <douglas.bagnall () catalyst net nz>\n * BUG 15997: CVE-2026-2340\n * BUG 16003: CVE-2026-3012\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408\n\no Pavel Kohout <pavel () aisle com>\n * BUG 15997: CVE-2026-2340\n\no Volker Lendecke <vl () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16012: CVE-2026-3238\n\no Stefan Metzmacher <metze () samba org>\n * BUG 15992: CVE-2026-1933\n * BUG 16033: CVE-2026-4480\n * BUG 16034: CVE-2026-4408', "has Homedir / In passwd\n\n#######################################\nReporting bugs & Development Discussion\n#######################################\n\nPlease discuss this release on the samba-technical mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you don't provide vital information to help us track down\nthe problem then you will…

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Missing access check on reparse point operations (CVE-2026-1933)

• samba: vfs_worm does not block directory modification (CVE-2026-2340)

• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

• ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)

• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Missing access check on reparse point operations (CVE-2026-1933)

• samba: vfs_worm does not block directory modification (CVE-2026-2340)

• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)

• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)

• ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)

• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Missing access check on reparse point operations (CVE-2026-1933)
• samba: vfs_worm does not block directory modification (CVE-2026-2340)
• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
• ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es):

• samba: Missing access check on reparse point operations (CVE-2026-1933)
• samba: vfs_worm does not block directory modification (CVE-2026-2340)
• samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
• samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)
• ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)
• samba: Remote Code Execution in SAMR (CVE-2026-4408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.

• CVE-2026-3012: do not trust CA certificates fetched over HTTP in the certificate auto-enrollment GP extension; use only LDAP-derived certificates and skip CAs with no cACertificate attribute
• CVE-2026-4408: escape shell metacharacters in the client-controlled username before substituting it into the "check password script" via %u, preventing remote command injection

• CVE-2026-3012: do not fetch certificates over HTTP during GPO certificate auto-enrollment; use only CA certificates obtained via LDAP and skip CAs not found in LDAP

• CVE-2026-3012: do not trust CA certificates fetched over HTTP in the certificate auto-enrollment GP extension; use only LDAP-derived certificates and skip CAs with no cACertificate attribute

These are all security issues fixed in the ctdb-4.23.8+git.477.f78166bceed-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues

Security issues:

• CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Changes for samba:

• network:samba:STABLE/samba: "use-kerberos=desired" broken / Dolphin requires login for Samba shares (bsc#1255755).
• Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
• samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
• VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
• Updated to 4.22.9

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

• CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
• CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
• CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
• CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
• CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
• CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
• CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
• CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
• CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
• CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
• CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
• CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
• CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

• samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
• Add python3-cryptography and python3-requests requirements for samba-python3.

This update for samba fixes the following issues

• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

This update for samba fixes the following issues

• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

This update for samba fixes the following issues

Security issues:

• CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Non security issue:

• network:samba:STABLE/samba: 'use-kerberos=desired' broken / Dolphin requires login for Samba shares (bsc#1255755).
• Generated dynamic profile based on path to special 'printers' share. (bsc#1259441).
• Fix regression 'use-kerberos=desired' broken doesn't even try to authenticate with kerberos and instead fallsback to NTLM (bsc#1255755).
• Fix memory leak using cups parsed options and filename allocated when processing end of printing job (bsc#1257200).
• Fix manpage for 'net offlinejoin requestodj'.
• Fix 'ctdbd socket' documentation in manpage for smb.conf
• Fix rpc workers with long living clients from growing server memory keytab and increasing memory used by workers (bsc#1257200).

This update for samba fixes the following issues

Security issues:

• CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Changes for samba:

• network:samba:STABLE/samba: "use-kerberos=desired" broken / Dolphin requires login for Samba shares (bsc#1255755).
• Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
• samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
• VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
• Updated to 4.22.9

This update for samba fixes the following issues

Security issues:

• CVE-2026-1933: Missing access check on reparse point operations (bsc#1261188).
• CVE-2026-2340: vfs_worm does not block directory modification (bsc#1261158).
• CVE-2026-3012: group policy certificate enrollment uses http: // without validation (bsc#1261159).
• CVE-2026-3238: unauthenticated udp packet crashes AD DC nbt server (bsc#1261160).
• CVE-2026-4408: Remote Code Execution in SAMR (bsc#1261163).
• CVE-2026-4480: Unauthenticated Remote Code Execution (bsc#1261161).

Changes for samba:

• network:samba:STABLE/samba: "use-kerberos=desired" broken / Dolphin requires login for Samba shares (bsc#1255755).
• Samba service start times out (SElinux relabel takes too long) (bsc#1259050).
• samba-ad-dc-libs packages is missing a DLZ plugin for bind 9.20 (bsc#1249058).
• VFS_Snapper does not show previous file versions in subdirectories. (bsc#1259667).
• Updated to 4.22.9

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

• CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
• CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
• CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
• CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
• CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
• CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
• CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
• CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
• CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
• CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
• CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
• CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
• CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

• samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
• Add python3-cryptography and python3-requests requirements for samba-python3.

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

• CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
• CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
• CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
• CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
• CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
• CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
• CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
• CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
• CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
• CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
• CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
• CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
• CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

• samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
• Add python3-cryptography and python3-requests requirements for samba-python3.

This update for samba fixes the following issues:

Update to 4.22.11.

Security issues fixed:

• CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr (bsc#1261188).
• CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with write access (bsc#1261158).
• CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).
• CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead to crash via crafted UDP packet (bsc#1261160).
• CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).
• CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem (bsc#1261161).
• CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
• CVE-2026-15779: pam_winbind module with mkhomedir set allows chown of critical system paths without validation (bsc#1271469).
• CVE-2026-58216: 6-byte heap OOB read in packet parser of the kpasswd service (bsc#1271674).
• CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication completes (bsc#1271675).
• CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).
• CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes (bsc#1271677).
• CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Other updates and bugfixes:

• samba-tool: do not complain of no subcommand with -V (bsc#1273189, bso#15770).
• Add python3-cryptography and python3-requests requirements for samba-python3.