{"id":"CVE-2026-15779","aliases":["DEBIAN-CVE-2026-15779","EUVD-2026-44662","GHSA-6fmw-7w5g-3pf9","OESA-2026-3364","OESA-2026-3365","OESA-2026-3410","OESA-2026-3411","OESA-2026-3412","SUSE-SU-2026:22977-1","SUSE-SU-2026:23003-1","SUSE-SU-2026:23129-1","SUSE-SU-2026:23152-1","SUSE-SU-2026:3362-1","SUSE-SU-2026:3363-1","SUSE-SU-2026:3364-1","SUSE-SU-2026:3365-1","SUSE-SU-2026:3366-1","SUSE-SU-2026:3367-1","UBUNTU-CVE-2026-15779","USN-8621-1","openSUSE-SU-2026:21475-1","openSUSE-SU-2026:21540-1"],"status":"published","title":"Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation","description":"A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00105,"percentile":0.01056,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2026-07-15T12:33:04Z","modified":"2026-11-06T10:04:37Z","fixes":[{"ecosystem":"openEuler:20.03-LTS-SP4","package":"samba","fixed_in":["4.11.12-40.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"samba","fixed_in":["4.17.5-18.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"samba","fixed_in":["4.19.3-11.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"samba","fixed_in":["4.19.3-11.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"samba","fixed_in":["4.19.3-11.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"samba","fixed_in":["2:4.15.13+dfsg-0ubuntu1.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"samba","fixed_in":["2:4.19.5+dfsg-4ubuntu9.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"samba","fixed_in":["2:4.23.6+dfsg-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.17.10+dfsg-0+deb12u1","2:4.17.10+dfsg-0+deb12u1~bpo11+1","2:4.17.11+dfsg-0+deb12u1","2:4.17.12+dfsg-0+deb12u1","2:4.17.12+dfsg-0+deb12u1~bpo11+1","2:4.17.12+dfsg-0+deb12u2","2:4.17.12+dfsg-0+deb12u3","2:4.17.12+dfsg-0+deb12u4","2:4.17.8+dfsg-2","2:4.17.8+dfsg-2.1","2:4.17.9+dfsg-0+deb12u1","2:4.17.9+dfsg-0+deb12u2","2:4.17.9+dfsg-0+deb12u3","2:4.17.9+dfsg-0+deb12u3~bpo11+1","2:4.18.0+dfsg-1~exp1","2:4.18.0~rc1+dfsg-1exp","2:4.18.0~rc2+dfsg-1","2:4.18.0~rc3+dfsg-1","2:4.18.0~rc4+dfsg-1","2:4.18.1+dfsg-1~exp1","2:4.18.2+dfsg-1","2:4.18.3+dfsg-1","2:4.18.3+dfsg-2","2:4.18.3+dfsg-3","2:4.18.4+dfsg-1","2:4.18.4+dfsg-2","2:4.18.4+dfsg-2~bpo12+1","2:4.18.5+dfsg-1","2:4.18.5+dfsg-2","2:4.18.5+dfsg-2~bpo12+1","2:4.18.6+dfsg-1","2:4.18.6+dfsg-1~bpo12+1","2:4.18.8+dfsg-1~bpo12+1","2:4.19.0+dfsg-1","2:4.19.0~rc1+dfsg-1","2:4.19.0~rc1+dfsg-2","2:4.19.0~rc1+dfsg-3","2:4.19.0~rc2+dfsg-1","2:4.19.0~rc4+dfsg-1","2:4.19.0~rc4+dfsg-2","2:4.19.1+dfsg-1","2:4.19.1+dfsg-2","2:4.19.1+dfsg-3","2:4.19.1+dfsg-4","2:4.19.2+dfsg-1","2:4.19.3+dfsg-1","2:4.19.3+dfsg-1~bpo12+1","2:4.19.3+dfsg-2","2:4.19.4+dfsg-1","2:4.19.4+dfsg-2","2:4.19.4+dfsg-2~bpo12+1","2:4.19.4+dfsg-3","2:4.19.4+dfsg-3~bpo12+1","2:4.19.5+dfsg-1","2:4.19.5+dfsg-2","2:4.19.5+dfsg-3","2:4.19.5+dfsg-4","2:4.19.5+dfsg-4~bpo12+1","2:4.19.5+dfsg-5","2:4.19.6+dfsg-1","2:4.19.6+dfsg-2","2:4.19.6+dfsg-3","2:4.19.6+dfsg-3~bpo12+1","2:4.20.0+dfsg-1~exp1","2:4.20.0+dfsg-1~exp2","2:4.20.0~rc1+dfsg-1","2:4.20.0~rc2+dfsg-1","2:4.20.0~rc2+dfsg-2","2:4.20.0~rc2+dfsg-3","2:4.20.1+dfsg-1","2:4.20.1+dfsg-2","2:4.20.1+dfsg-3","2:4.20.1+dfsg-4","2:4.20.1+dfsg-4~bpo12+1","2:4.20.1+dfsg-5","2:4.20.2+dfsg-1","2:4.20.2+dfsg-10","2:4.20.2+dfsg-2","2:4.20.2+dfsg-2~bpo12+1","2:4.20.2+dfsg-2~bpo12+2","2:4.20.2+dfsg-3","2:4.20.2+dfsg-4","2:4.20.2+dfsg-5","2:4.20.2+dfsg-5~bpo12+1","2:4.20.2+dfsg-6","2:4.20.2+dfsg-6~bpo12+1","2:4.20.2+dfsg-7","2:4.20.2+dfsg-8","2:4.20.2+dfsg-9","2:4.20.2+dfsg-9~exp1","2:4.20.2+dfsg-9~exp2","2:4.20.4+dfsg-1~bpo12+1","2:4.20.5+dfsg-1~bpo12+1","2:4.21.0+dfsg-1","2:4.21.0~rc1+dfsg-1","2:4.21.0~rc1+really4.20.2+dfsg-11","2:4.21.0~rc1+really4.20.2+dfsg-11r","2:4.21.0~rc1+really4.20.3+dfsg-1","2:4.21.0~rc1+really4.20.4+dfsg-1","2:4.21.0~rc2+dfsg-1","2:4.21.1+dfsg-1","2:4.21.1+dfsg-1~bpo12+1","2:4.21.1+dfsg-2","2:4.21.1+dfsg-2+hurd.1","2:4.21.1+dfsg-2~bpo12+1","2:4.21.2+dfsg-1","2:4.21.2+dfsg-2","2:4.21.2+dfsg-3","2:4.21.2+dfsg-3~bpo12+1","2:4.21.2+dfsg-4","2:4.21.2+dfsg-4+hurd.1","2:4.21.2+dfsg-4~exp1","2:4.21.3+dfsg-1","2:4.21.3+dfsg-1~bpo12+1","2:4.21.3+dfsg-2","2:4.21.3+dfsg-3","2:4.21.3+dfsg-4","2:4.21.3+dfsg-4~bpo12+1","2:4.21.3+dfsg-5","2:4.21.3+dfsg-5~bpo12+1","2:4.21.3+dfsg-6","2:4.21.3+dfsg-6~bpo12+1","2:4.21.4+dfsg-1","2:4.21.4+dfsg-1~bpo12+1","2:4.21.5+dfsg-1~bpo12+1","2:4.22.0+dfsg-1","2:4.22.0+dfsg-2","2:4.22.0+dfsg-3","2:4.22.0~rc1+dfsg-1","2:4.22.1+dfsg-1","2:4.22.1+dfsg-1~bpo12+1","2:4.22.2+dfsg-1","2:4.22.2+dfsg-1~bpo12+1","2:4.22.3+dfsg-1","2:4.22.3+dfsg-2","2:4.22.3+dfsg-2~bpo12+1","2:4.22.3+dfsg-3","2:4.22.3+dfsg-4","2:4.22.3+dfsg-4~bpo12+1","2:4.22.4+dfsg-1","2:4.22.4+dfsg-1~deb13u1","2:4.22.4+dfsg-1~deb13u1~bpo12+1","2:4.23.0+dfsg-1","2:4.23.0+dfsg-2","2:4.23.0+dfsg-3","2:4.23.0~rc1+dfsg-1","2:4.23.0~rc2+dfsg-1","2:4.23.0~rc3+dfsg-1","2:4.23.1+dfsg-1","2:4.23.2+dfsg-1","2:4.23.3+dfsg-1","2:4.23.3+dfsg-1~bpo13+1","2:4.23.4+dfsg-1","2:4.23.4+dfsg-1~bpo13+1","2:4.23.5+dfsg-1","2:4.23.5+dfsg-1~bpo13+1","2:4.23.6+dfsg-1","2:4.23.6+dfsg-2","2:4.23.6+dfsg-2~bpo13+1","2:4.24.0+dfsg-1","2:4.24.0~rc1+dfsg-1","2:4.24.0~rc1+dfsg-2","2:4.24.0~rc1+dfsg-3","2:4.24.0~rc2+dfsg-1","2:4.24.1+dfsg-1","2:4.24.2+dfsg-1","2:4.24.2+dfsg-1~bpo13+1","2:4.24.3+dfsg-1","2:4.24.3+dfsg-1~bpo13+1","2:4.24.4+dfsg-1","2:4.24.4+dfsg-1~bpo13+1","2:4.24.5+dfsg-1","2:4.24.5+dfsg-1~bpo13+1","2:4.24.6+dfsg-1","2:4.24.7+dfsg-1","2:4.24.7+dfsg-1~bpo13+1","2:4.25.0+dfsg-1","2:4.25.0~rc1+dfsg-1","2:4.25.1+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.22.10+dfsg-0+deb13u1","2:4.22.10+dfsg-0+deb13u2","2:4.22.11+dfsg-0+deb13u1","2:4.22.3+dfsg-4","2:4.22.4+dfsg-1","2:4.22.4+dfsg-1~deb13u1","2:4.22.4+dfsg-1~deb13u1~bpo12+1","2:4.22.6+dfsg-0+deb13u1","2:4.22.6+dfsg-0+deb13u1~bpo12+1","2:4.22.8+dfsg-0+deb13u1","2:4.22.8+dfsg-0+deb13u2","2:4.23.0+dfsg-1","2:4.23.0+dfsg-2","2:4.23.0+dfsg-3","2:4.23.0~rc1+dfsg-1","2:4.23.0~rc2+dfsg-1","2:4.23.0~rc3+dfsg-1","2:4.23.1+dfsg-1","2:4.23.2+dfsg-1","2:4.23.3+dfsg-1","2:4.23.3+dfsg-1~bpo13+1","2:4.23.4+dfsg-1","2:4.23.4+dfsg-1~bpo13+1","2:4.23.5+dfsg-1","2:4.23.5+dfsg-1~bpo13+1","2:4.23.6+dfsg-1","2:4.23.6+dfsg-2","2:4.23.6+dfsg-2~bpo13+1","2:4.24.0+dfsg-1","2:4.24.0~rc1+dfsg-1","2:4.24.0~rc1+dfsg-2","2:4.24.0~rc1+dfsg-3","2:4.24.0~rc2+dfsg-1","2:4.24.1+dfsg-1","2:4.24.2+dfsg-1","2:4.24.2+dfsg-1~bpo13+1","2:4.24.3+dfsg-1","2:4.24.3+dfsg-1~bpo13+1","2:4.24.4+dfsg-1","2:4.24.4+dfsg-1~bpo13+1","2:4.24.5+dfsg-1","2:4.24.5+dfsg-1~bpo13+1","2:4.24.6+dfsg-1","2:4.24.7+dfsg-1","2:4.24.7+dfsg-1~bpo13+1","2:4.25.0+dfsg-1","2:4.25.0~rc1+dfsg-1","2:4.25.1+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.22.3+dfsg-4","2:4.22.4+dfsg-1","2:4.22.4+dfsg-1~deb13u1","2:4.22.4+dfsg-1~deb13u1~bpo12+1","2:4.23.0+dfsg-1","2:4.23.0+dfsg-2","2:4.23.0+dfsg-3","2:4.23.0~rc1+dfsg-1","2:4.23.0~rc2+dfsg-1","2:4.23.0~rc3+dfsg-1","2:4.23.1+dfsg-1","2:4.23.2+dfsg-1","2:4.23.3+dfsg-1","2:4.23.3+dfsg-1~bpo13+1","2:4.23.4+dfsg-1","2:4.23.4+dfsg-1~bpo13+1","2:4.23.5+dfsg-1","2:4.23.5+dfsg-1~bpo13+1","2:4.23.6+dfsg-1","2:4.23.6+dfsg-2","2:4.23.6+dfsg-2~bpo13+1","2:4.24.0+dfsg-1","2:4.24.0~rc1+dfsg-1","2:4.24.0~rc1+dfsg-2","2:4.24.0~rc1+dfsg-3","2:4.24.0~rc2+dfsg-1","2:4.24.1+dfsg-1","2:4.24.2+dfsg-1","2:4.24.2+dfsg-1~bpo13+1","2:4.24.3+dfsg-1","2:4.24.3+dfsg-1~bpo13+1","2:4.24.4+dfsg-1","2:4.24.4+dfsg-1~bpo13+1","2:4.24.5+dfsg-1","2:4.24.5+dfsg-1~bpo13+1","2:4.24.6+dfsg-1","2:4.24.7+dfsg-1","2:4.24.7+dfsg-1~bpo13+1","2:4.25.0+dfsg-1","2:4.25.0~rc1+dfsg-1","2:4.25.1+dfsg-1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.12-40.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.5-18.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.3-11.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.3-11.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.3-11.oe2403sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22.9+git.538.af6cb4fb2e-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22.11+git.552.66cfeb7de0a-160000.1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22.11+git.552.66cfeb7de0a-160000.1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22.11+git.552.66cfeb7de0a-160000.1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22.11+git.552.66cfeb7de0a-160000.1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22.11+git.552.66cfeb7de0a-160000.1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.808.eeca19f5e1-150400.3.52.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.808.eeca19f5e1-150400.3.52.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.808.eeca19f5e1-150400.3.52.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.808.eeca19f5e1-150400.3.52.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.808.eeca19f5e1-150400.3.52.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.808.eeca19f5e1-150400.3.52.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.808.eeca19f5e1-150400.3.52.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.10+git.533.31d7e5508d-150700.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21.10+git.533.31d7e5508d-150700.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.8+git.501.67274891bc-150600.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.8+git.501.67274891bc-150600.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.8+git.501.67274891bc-150600.3.29.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.12+git.581.f49579c6cd-150500.3.42.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.12+git.581.f49579c6cd-150500.3.42.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.12+git.581.f49579c6cd-150500.3.42.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.12+git.581.f49579c6cd-150500.3.42.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.12+git.581.f49579c6cd-150500.3.42.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.12+git.581.f49579c6cd-150500.3.42.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.808.eeca19f5e1-150300.3.106.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.729.a8ce057e8d-3.109.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.729.a8ce057e8d-3.109.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.13+git.729.a8ce057e8d-3.109.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.6.18-1ubuntu3","2:4.0.10+dfsg-4ubuntu2","2:4.0.13+dfsg-1ubuntu1","2:4.1.3+dfsg-2ubuntu2","2:4.1.3+dfsg-2ubuntu3","2:4.1.3+dfsg-2ubuntu4","2:4.1.3+dfsg-2ubuntu5","2:4.1.6+dfsg-1ubuntu1","2:4.1.6+dfsg-1ubuntu2","2:4.1.6+dfsg-1ubuntu2.14.04.1","2:4.1.6+dfsg-1ubuntu2.14.04.2","2:4.1.6+dfsg-1ubuntu2.14.04.3","2:4.1.6+dfsg-1ubuntu2.14.04.4","2:4.1.6+dfsg-1ubuntu2.14.04.5","2:4.1.6+dfsg-1ubuntu2.14.04.7","2:4.1.6+dfsg-1ubuntu2.14.04.8","2:4.1.6+dfsg-1ubuntu2.14.04.9","2:4.1.6+dfsg-1ubuntu2.14.04.11","2:4.1.6+dfsg-1ubuntu2.14.04.12","2:4.1.6+dfsg-1ubuntu2.14.04.13","2:4.3.8+dfsg-0ubuntu0.14.04.2","2:4.3.9+dfsg-0ubuntu0.14.04.1","2:4.3.9+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.1","2:4.3.11+dfsg-0ubuntu0.14.04.2","2:4.3.11+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.4","2:4.3.11+dfsg-0ubuntu0.14.04.6","2:4.3.11+dfsg-0ubuntu0.14.04.7","2:4.3.11+dfsg-0ubuntu0.14.04.8","2:4.3.11+dfsg-0ubuntu0.14.04.9","2:4.3.11+dfsg-0ubuntu0.14.04.10","2:4.3.11+dfsg-0ubuntu0.14.04.11","2:4.3.11+dfsg-0ubuntu0.14.04.12","2:4.3.11+dfsg-0ubuntu0.14.04.13","2:4.3.11+dfsg-0ubuntu0.14.04.14","2:4.3.11+dfsg-0ubuntu0.14.04.16","2:4.3.11+dfsg-0ubuntu0.14.04.17","2:4.3.11+dfsg-0ubuntu0.14.04.19","2:4.3.11+dfsg-0ubuntu0.14.04.20","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm1","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm2","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm3","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm4","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm6","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm7","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm8","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm9","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm11","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm12","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm13","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm14","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.17+dfsg-4ubuntu2","2:4.1.20+dfsg-1ubuntu1","2:4.1.20+dfsg-1ubuntu2","2:4.1.20+dfsg-1ubuntu3","2:4.1.20+dfsg-1ubuntu5","2:4.3.3+dfsg-1ubuntu1","2:4.3.3+dfsg-1ubuntu2","2:4.3.3+dfsg-1ubuntu3","2:4.3.6+dfsg-1ubuntu1","2:4.3.8+dfsg-0ubuntu1","2:4.3.9+dfsg-0ubuntu0.16.04.1","2:4.3.9+dfsg-0ubuntu0.16.04.2","2:4.3.9+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.1","2:4.3.11+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.5","2:4.3.11+dfsg-0ubuntu0.16.04.6","2:4.3.11+dfsg-0ubuntu0.16.04.7","2:4.3.11+dfsg-0ubuntu0.16.04.8","2:4.3.11+dfsg-0ubuntu0.16.04.9","2:4.3.11+dfsg-0ubuntu0.16.04.10","2:4.3.11+dfsg-0ubuntu0.16.04.11","2:4.3.11+dfsg-0ubuntu0.16.04.12","2:4.3.11+dfsg-0ubuntu0.16.04.13","2:4.3.11+dfsg-0ubuntu0.16.04.15","2:4.3.11+dfsg-0ubuntu0.16.04.16","2:4.3.11+dfsg-0ubuntu0.16.04.17","2:4.3.11+dfsg-0ubuntu0.16.04.18","2:4.3.11+dfsg-0ubuntu0.16.04.19","2:4.3.11+dfsg-0ubuntu0.16.04.20","2:4.3.11+dfsg-0ubuntu0.16.04.21","2:4.3.11+dfsg-0ubuntu0.16.04.23","2:4.3.11+dfsg-0ubuntu0.16.04.24","2:4.3.11+dfsg-0ubuntu0.16.04.25","2:4.3.11+dfsg-0ubuntu0.16.04.26","2:4.3.11+dfsg-0ubuntu0.16.04.27","2:4.3.11+dfsg-0ubuntu0.16.04.28","2:4.3.11+dfsg-0ubuntu0.16.04.29","2:4.3.11+dfsg-0ubuntu0.16.04.30","2:4.3.11+dfsg-0ubuntu0.16.04.31","2:4.3.11+dfsg-0ubuntu0.16.04.32","2:4.3.11+dfsg-0ubuntu0.16.04.34","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm1","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm2","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm3","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.6.7+dfsg-1ubuntu3","2:4.7.1+dfsg-1ubuntu1","2:4.7.3+dfsg-1ubuntu1","2:4.7.4+dfsg-1ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu2","2:4.7.6+dfsg~ubuntu-0ubuntu2.2","2:4.7.6+dfsg~ubuntu-0ubuntu2.4","2:4.7.6+dfsg~ubuntu-0ubuntu2.5","2:4.7.6+dfsg~ubuntu-0ubuntu2.6","2:4.7.6+dfsg~ubuntu-0ubuntu2.7","2:4.7.6+dfsg~ubuntu-0ubuntu2.9","2:4.7.6+dfsg~ubuntu-0ubuntu2.10","2:4.7.6+dfsg~ubuntu-0ubuntu2.11","2:4.7.6+dfsg~ubuntu-0ubuntu2.13","2:4.7.6+dfsg~ubuntu-0ubuntu2.14","2:4.7.6+dfsg~ubuntu-0ubuntu2.15","2:4.7.6+dfsg~ubuntu-0ubuntu2.16","2:4.7.6+dfsg~ubuntu-0ubuntu2.17","2:4.7.6+dfsg~ubuntu-0ubuntu2.18","2:4.7.6+dfsg~ubuntu-0ubuntu2.19","2:4.7.6+dfsg~ubuntu-0ubuntu2.20","2:4.7.6+dfsg~ubuntu-0ubuntu2.21","2:4.7.6+dfsg~ubuntu-0ubuntu2.23","2:4.7.6+dfsg~ubuntu-0ubuntu2.24","2:4.7.6+dfsg~ubuntu-0ubuntu2.26","2:4.7.6+dfsg~ubuntu-0ubuntu2.27","2:4.7.6+dfsg~ubuntu-0ubuntu2.28","2:4.7.6+dfsg~ubuntu-0ubuntu2.29","2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm1","2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm2","2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.10.7+dfsg-0ubuntu2","2:4.10.7+dfsg-0ubuntu3","2:4.11.1+dfsg-3ubuntu1","2:4.11.1+dfsg-3ubuntu2","2:4.11.1+dfsg-3ubuntu4","2:4.11.5+dfsg-1ubuntu1","2:4.11.5+dfsg-1ubuntu2","2:4.11.6+dfsg-0ubuntu1","2:4.11.6+dfsg-0ubuntu1.1","2:4.11.6+dfsg-0ubuntu1.2","2:4.11.6+dfsg-0ubuntu1.3","2:4.11.6+dfsg-0ubuntu1.4","2:4.11.6+dfsg-0ubuntu1.5","2:4.11.6+dfsg-0ubuntu1.6","2:4.11.6+dfsg-0ubuntu1.8","2:4.11.6+dfsg-0ubuntu1.9","2:4.11.6+dfsg-0ubuntu1.10","2:4.13.14+dfsg-0ubuntu0.20.04.1","2:4.13.14+dfsg-0ubuntu0.20.04.2","2:4.13.14+dfsg-0ubuntu0.20.04.3","2:4.13.14+dfsg-0ubuntu0.20.04.4","2:4.13.17~dfsg-0ubuntu0.21.04.1","2:4.13.17~dfsg-0ubuntu0.21.04.2","2:4.13.17~dfsg-0ubuntu1.20.04.1","2:4.13.17~dfsg-0ubuntu1.20.04.2","2:4.13.17~dfsg-0ubuntu1.20.04.4","2:4.13.17~dfsg-0ubuntu1.20.04.5","2:4.15.13+dfsg-0ubuntu0.20.04.1","2:4.15.13+dfsg-0ubuntu0.20.04.2","2:4.15.13+dfsg-0ubuntu0.20.04.3","2:4.15.13+dfsg-0ubuntu0.20.04.4","2:4.15.13+dfsg-0ubuntu0.20.04.5","2:4.15.13+dfsg-0ubuntu0.20.04.6","2:4.15.13+dfsg-0ubuntu0.20.04.7","2:4.15.13+dfsg-0ubuntu0.20.04.8","2:4.15.13+dfsg-0ubuntu0.20.04.8+esm1","2:4.15.13+dfsg-0ubuntu0.20.04.8+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu1.13"}]}],"versions":["2:4.13.5+dfsg-2ubuntu2","2:4.13.5+dfsg-2ubuntu3","2:4.13.14+dfsg-0ubuntu1","2:4.13.14+dfsg-0ubuntu2","2:4.15.5~dfsg-0ubuntu1","2:4.15.5~dfsg-0ubuntu2","2:4.15.5~dfsg-0ubuntu4","2:4.15.5~dfsg-0ubuntu5","2:4.15.5~dfsg-0ubuntu5.1","2:4.15.9+dfsg-0ubuntu0.2","2:4.15.9+dfsg-0ubuntu0.3","2:4.15.13+dfsg-0ubuntu1","2:4.15.13+dfsg-0ubuntu1.1","2:4.15.13+dfsg-0ubuntu1.2","2:4.15.13+dfsg-0ubuntu1.3","2:4.15.13+dfsg-0ubuntu1.4","2:4.15.13+dfsg-0ubuntu1.5","2:4.15.13+dfsg-0ubuntu1.6","2:4.15.13+dfsg-0ubuntu1.7","2:4.15.13+dfsg-0ubuntu1.8","2:4.15.13+dfsg-0ubuntu1.9","2:4.15.13+dfsg-0ubuntu1.10","2:4.15.13+dfsg-0ubuntu1.12"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.19.5+dfsg-4ubuntu9.7"}]}],"versions":["2:4.18.6+dfsg-1ubuntu2","2:4.18.6+dfsg-1ubuntu2.1","2:4.18.6+dfsg-1ubuntu2.2","2:4.19.4+dfsg-3ubuntu1","2:4.19.5+dfsg-1ubuntu1","2:4.19.5+dfsg-4ubuntu7","2:4.19.5+dfsg-4ubuntu8","2:4.19.5+dfsg-4ubuntu9","2:4.19.5+dfsg-4ubuntu9.2","2:4.19.5+dfsg-4ubuntu9.3","2:4.19.5+dfsg-4ubuntu9.4","2:4.19.5+dfsg-4ubuntu9.6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.23.6+dfsg-1ubuntu2.2"}]}],"versions":["2:4.22.3+dfsg-4ubuntu2","2:4.22.3+dfsg-4ubuntu2.1","2:4.22.3+dfsg-4ubuntu3","2:4.22.3+dfsg-4ubuntu4","2:4.23.4+dfsg-1ubuntu1","2:4.23.5+dfsg-1ubuntu2","2:4.23.6+dfsg-1ubuntu1","2:4.23.6+dfsg-1ubuntu2","2:4.23.6+dfsg-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.15.13+dfsg-0ubuntu1.13"}]}],"versions":["2:4.13.5+dfsg-2ubuntu2","2:4.13.5+dfsg-2ubuntu3","2:4.13.14+dfsg-0ubuntu1","2:4.13.14+dfsg-0ubuntu2","2:4.15.5~dfsg-0ubuntu1","2:4.15.5~dfsg-0ubuntu2","2:4.15.5~dfsg-0ubuntu4","2:4.15.5~dfsg-0ubuntu5","2:4.15.5~dfsg-0ubuntu5.1","2:4.15.9+dfsg-0ubuntu0.2","2:4.15.9+dfsg-0ubuntu0.3","2:4.15.13+dfsg-0ubuntu1","2:4.15.13+dfsg-0ubuntu1.1","2:4.15.13+dfsg-0ubuntu1.2","2:4.15.13+dfsg-0ubuntu1.3","2:4.15.13+dfsg-0ubuntu1.4","2:4.15.13+dfsg-0ubuntu1.5","2:4.15.13+dfsg-0ubuntu1.6","2:4.15.13+dfsg-0ubuntu1.7","2:4.15.13+dfsg-0ubuntu1.8","2:4.15.13+dfsg-0ubuntu1.9","2:4.15.13+dfsg-0ubuntu1.10","2:4.15.13+dfsg-0ubuntu1.12"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.19.5+dfsg-4ubuntu9.7"}]}],"versions":["2:4.18.6+dfsg-1ubuntu2","2:4.18.6+dfsg-1ubuntu2.1","2:4.18.6+dfsg-1ubuntu2.2","2:4.19.4+dfsg-3ubuntu1","2:4.19.5+dfsg-1ubuntu1","2:4.19.5+dfsg-4ubuntu7","2:4.19.5+dfsg-4ubuntu8","2:4.19.5+dfsg-4ubuntu9","2:4.19.5+dfsg-4ubuntu9.2","2:4.19.5+dfsg-4ubuntu9.3","2:4.19.5+dfsg-4ubuntu9.4","2:4.19.5+dfsg-4ubuntu9.6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.23.6+dfsg-1ubuntu2.2"}]}],"versions":["2:4.22.3+dfsg-4ubuntu2","2:4.22.3+dfsg-4ubuntu2.1","2:4.22.3+dfsg-4ubuntu3","2:4.22.3+dfsg-4ubuntu4","2:4.23.4+dfsg-1ubuntu1","2:4.23.5+dfsg-1ubuntu2","2:4.23.6+dfsg-1ubuntu1","2:4.23.6+dfsg-1ubuntu2","2:4.23.6+dfsg-1ubuntu2.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22.9+git.538.af6cb4fb2e-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22.11+git.552.66cfeb7de0a-160000.1.1"}]}],"bundled":13}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-15779","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499991","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.com/samba-team/samba/-/blob/samba-4.19.4/nsswitch/pam_winbind.c"},{"url":"https://gitlab.com/samba-team/samba/-/blob/samba-4.23.5/nsswitch/pam_winbind.c#L1622"},{"url":"https://gitlab.com/samba-team/samba/-/blob/samba-4.24.3/nsswitch/pam_winbind.c#L1590"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15779","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6fmw-7w5g-3pf9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-15779","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3364","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3365","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3410","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3411","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3412","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622977-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271469","tags":["report"]},{"url":"https://bugzilla.suse.com/1271672","tags":["report"]},{"url":"https://bugzilla.suse.com/1271673","tags":["report"]},{"url":"https://bugzilla.suse.com/1271674","tags":["report"]},{"url":"https://bugzilla.suse.com/1271675","tags":["report"]},{"url":"https://bugzilla.suse.com/1271676","tags":["report"]},{"url":"https://bugzilla.suse.com/1271677","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6949","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623003-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261158","tags":["report"]},{"url":"https://bugzilla.suse.com/1261159","tags":["report"]},{"url":"https://bugzilla.suse.com/1261160","tags":["report"]},{"url":"https://bugzilla.suse.com/1261161","tags":["report"]},{"url":"https://bugzilla.suse.com/1261163","tags":["report"]},{"url":"https://bugzilla.suse.com/1261188","tags":["report"]},{"url":"https://bugzilla.suse.com/1273189","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4480","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623129-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623152-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263362-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263363-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263364-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263365-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263366-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263367-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-15779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15779","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8621-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58224","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-15779","title":"Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation","description":"A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.","status":"published","published":"2026-07-15T12:33:04.688Z","modified":"2026-11-05T16:42:54.277Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-05T17:53:58.925122Z"}],"euvd":[{"id":"EUVD-2026-44662","description":"A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.","status":"published","published":"2026-07-15T12:33:04Z","modified":"2026-11-05T16:42:54Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-05T18:00:57.863749Z"}],"ghsa":[{"id":"GHSA-6fmw-7w5g-3pf9","title":"A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target...","description":"A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.","status":"published","published":"2026-07-15T15:33:03Z","modified":"2026-07-15T15:33:03Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:09:33.182129Z"}],"nvd":[{"id":"CVE-2026-15779","description":"A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.","status":"published","published":"2026-07-15T13:17:03.65Z","modified":"2026-11-05T17:18:10.397Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-05T19:55:55.702046Z"}],"osv":[{"id":"DEBIAN-CVE-2026-15779","description":"A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.","status":"published","published":"2026-07-15T13:17:03.65Z","modified":"2026-11-06T10:04:37.170443888Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"OESA-2026-3364","title":"samba security update","description":"Samba is a suite of programs for Linux and Unix to interoperate with Windows.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in samba\u0026apos;s pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account\u0026apos;s home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.(CVE-2026-15779)","status":"published","published":"2026-08-13T14:01:34Z","modified":"2026-08-16T01:45:19.070489195Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3365","title":"samba security update","description":"Samba is a suite of programs for Linux and Unix to interoperate with Windows.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in samba\u0026apos;s pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account\u0026apos;s home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.(CVE-2026-15779)","status":"published","published":"2026-08-13T14:01:35Z","modified":"2026-08-16T01:45:19.094156262Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3410","title":"samba security update","description":"Samba is a suite of programs for Linux and Unix to interoperate with Windows.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in samba\u0026apos;s pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account\u0026apos;s home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.(CVE-2026-15779)","status":"published","published":"2026-08-20T09:54:49Z","modified":"2026-08-20T10:15:06.405634447Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3411","title":"samba security update","description":"Samba is a suite of programs for Linux and Unix to interoperate with Windows.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in samba\u0026apos;s pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account\u0026apos;s home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.(CVE-2026-15779)","status":"published","published":"2026-08-20T09:54:49Z","modified":"2026-08-20T10:15:06.398270925Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3412","title":"samba security update","description":"Samba is a suite of programs for Linux and Unix to interoperate with Windows.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in samba\u0026apos;s pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account\u0026apos;s home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.(CVE-2026-15779)","status":"published","published":"2026-08-20T09:54:50Z","modified":"2026-08-20T10:15:07.863127017Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"UBUNTU-CVE-2026-15779","description":"A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.","status":"published","published":"2026-07-15T13:17:00Z","modified":"2026-07-28T21:27:02.974568472Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"openSUSE-SU-2026:21475-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\n- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).\n- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation\n  (bsc#1271469).\n- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).\n- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication\n  completes (bsc#1271675).\n- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).\n- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes\n  (bsc#1271677).\n- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).\n","status":"published","published":"2026-07-29T05:01:08Z","modified":"2026-07-31T18:24:08.583814466Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21540-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\nUpdate to 4.22.11.\n\nSecurity issues fixed:\n\n- CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the\n  `user.SmbReparse` xattr (bsc#1261188).\n- CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with\n  write access (bsc#1261158).\n- CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).\n- CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead\n  to crash via crafted UDP packet (bsc#1261160).\n- CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).\n- CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem\n  (bsc#1261161).\n- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).\n- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation\n  (bsc#1271469).\n- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).\n- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication\n  completes (bsc#1271675).\n- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).\n- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes\n  (bsc#1271677).\n- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).\n\nOther updates and bugfixes:\n\n- `samba-tool`: do not complain of no subcommand with `-V` (bsc#1273189, bso#15770).\n- Add `python3-cryptography` and `python3-requests` requirements for `samba-python3`.\n","status":"published","published":"2026-08-06T09:33:09Z","modified":"2026-08-08T18:23:58.443729944Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22977-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\n- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).\n- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation\n  (bsc#1271469).\n- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).\n- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication\n  completes (bsc#1271675).\n- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).\n- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes\n  (bsc#1271677).\n- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).\n","status":"published","published":"2026-07-29T04:55:06Z","modified":"2026-08-04T18:23:41.980840616Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23003-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\nUpdate to 4.22.11.\n\nSecurity issues fixed:\n\n- CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the\n  `user.SmbReparse` xattr (bsc#1261188).\n- CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with\n  write access (bsc#1261158).\n- CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).\n- CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead\n  to crash via crafted UDP packet (bsc#1261160).\n- CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).\n- CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem\n  (bsc#1261161).\n- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).\n- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation\n  (bsc#1271469).\n- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).\n- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication\n  completes (bsc#1271675).\n- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).\n- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes\n  (bsc#1271677).\n- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).\n\nOther updates and bugfixes:\n\n- `samba-tool`: do not complain of no subcommand with `-V` (bsc#1273189, bso#15770).\n- Add `python3-cryptography` and `python3-requests` requirements for `samba-python3`.\n","status":"published","published":"2026-08-06T09:27:44Z","modified":"2026-08-12T18:23:35.880900792Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23129-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\nUpdate to 4.22.11.\n\nSecurity issues fixed:\n\n- CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the\n  `user.SmbReparse` xattr (bsc#1261188).\n- CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with\n  write access (bsc#1261158).\n- CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).\n- CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead\n  to crash via crafted UDP packet (bsc#1261160).\n- CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).\n- CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem\n  (bsc#1261161).\n- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).\n- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation\n  (bsc#1271469).\n- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).\n- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication\n  completes (bsc#1271675).\n- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).\n- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes\n  (bsc#1271677).\n- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).\n\nOther updates and bugfixes:\n\n- `samba-tool`: do not complain of no subcommand with `-V` (bsc#1273189, bso#15770).\n- Add `python3-cryptography` and `python3-requests` requirements for `samba-python3`.\n","status":"published","published":"2026-08-06T09:27:44Z","modified":"2026-08-14T18:23:40.117567547Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23152-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\nUpdate to 4.22.11.\n\nSecurity issues fixed:\n\n- CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the\n  `user.SmbReparse` xattr (bsc#1261188).\n- CVE-2026-2340: WORM vfs module does not block directory modification and allows file changes by any user with\n  write access (bsc#1261158).\n- CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification (bsc#1261159).\n- CVE-2026-3238: NULL pointer dereference in the WINS server compoenent of the AD domain controller code can lead\n  to crash via crafted UDP packet (bsc#1261160).\n- CVE-2026-4408: improper escaping allows for remote command execution via the DCE/RPC SAMR server (bsc#1261163).\n- CVE-2026-4480: improper escaping allows for unauthenticated remote code execution via the printing subsystem\n  (bsc#1261161).\n- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).\n- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation\n  (bsc#1271469).\n- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).\n- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication\n  completes (bsc#1271675).\n- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).\n- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes\n  (bsc#1271677).\n- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).\n\nOther updates and bugfixes:\n\n- `samba-tool`: do not complain of no subcommand with `-V` (bsc#1273189, bso#15770).\n- Add `python3-cryptography` and `python3-requests` requirements for `samba-python3`.\n","status":"published","published":"2026-08-06T09:27:44Z","modified":"2026-08-14T18:23:41.55619733Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3362-1","title":"Security update for samba","description":"This update for samba fixes the following issues\n\n- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).\n- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation\n  (bsc#1271469).\n- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).\n- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication\n  completes (bsc#1271675).\n- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).\n- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes\n  (bsc#1271677).\n- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).\n","status":"published","published":"2026-07-28T12:18:44Z","modified":"2026-07-29T09:00:06.310039327Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3363-1","title":"Security update for samba","description":"This update for samba fixes the following issues\n\n- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).\n- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation\n  (bsc#1271469).\n- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).\n- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication\n  completes (bsc#1271675).\n- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).\n- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes\n  (bsc#1271677).\n- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).\n","status":"published","published":"2026-07-28T12:19:16Z","modified":"2026-07-29T09:00:06.320218046Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3364-1","title":"Security update for samba","description":"This update for samba fixes the following issues\n\n- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).\n- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation\n  (bsc#1271469).\n- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).\n- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication\n  completes (bsc#1271675).\n- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).\n- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes\n  (bsc#1271677).\n- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).\n","status":"published","published":"2026-07-28T12:19:48Z","modified":"2026-07-29T09:00:06.326518457Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3365-1","title":"Security update for samba","description":"This update for samba fixes the following issues\n\n- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).\n- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation\n  (bsc#1271469).\n- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).\n- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication\n  completes (bsc#1271675).\n- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).\n- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes\n  (bsc#1271677).\n- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).\n","status":"published","published":"2026-07-28T12:20:54Z","modified":"2026-07-29T09:00:06.307576071Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3366-1","title":"Security update for samba","description":"This update for samba fixes the following issues\n\n- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).\n- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation\n  (bsc#1271469).\n- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).\n- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication\n  completes (bsc#1271675).\n- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).\n- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes\n  (bsc#1271677).\n- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).\n","status":"published","published":"2026-07-28T12:21:22Z","modified":"2026-07-29T09:00:06.274692544Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3367-1","title":"Security update for samba","description":"This update for samba fixes the following issues\n\n- CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).\n- CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths without validation\n  (bsc#1271469).\n- CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).\n- CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before authentication\n  completes (bsc#1271675).\n- CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover (bsc#1271676).\n- CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected attributes\n  (bsc#1271677).\n- CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).\n","status":"published","published":"2026-07-28T12:22:46Z","modified":"2026-07-29T09:00:06.358253215Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8621-1","title":"samba vulnerabilities","description":"It was discovered that Samba's pam_winbind incorrectly handled home\ndirectory ownership when mkhomedir was enabled. A local attacker could\npossibly use this issue to cause a denial of service by triggering a change\nin ownership of the root directory. (CVE-2026-15779)\n\nArjun Basnet, Douglas Bagnall, and Andrew Tridgell discovered that Samba\nincorrectly handled TSIG packets with name compression. A remote attacker\ncould possibly use this issue to cause Samba to crash, resulting in a\ndenial of service. (CVE-2026-6949)\n\nTristan Madani discovered that Samba incorrectly handled malformed ASN.1\nkpasswd packets. An authenticated user could possibly use this issue to\ncause Samba to crash, resulting in a denial of service. (CVE-2026-58216)\n\nAndrew Tridgell and Tristan Madani discovered that Samba incorrectly\nhandled TKEY name registration. A remote attacker could possibly use this\nissue to exhaust the TKEY name cache, resulting in a denial of service.\n(CVE-2026-58218)\n\nIt was discovered that Samba incorrectly handled internal LDB special\ndirectory names when processing authenticated LDAP requests. An\nauthenticated user could possibly use this issue to perform unauthorized\nmodifications and gain control of a domain. (CVE-2026-58221)\n\nAndrew Tridgell and Tristan Madani discovered that Samba incorrectly\nhandled LDAP Compare requests. An authenticated user could possibly use\nthis issue to obtain sensitive information. (CVE-2026-58222)\n\nTristan Madani, Andrew Tridgell, and Martin Schwenke discovered that the\nCTDB protocol in Samba had insufficient bounds checking. A remote attacker\ncould possibly use this issue to cause Samba to crash, resulting in a\ndenial of service. (CVE-2026-58224)","status":"published","published":"2026-07-28T11:50:00Z","modified":"2026-08-17T12:31:32.544955314Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}