Junglewise Threat Intelligence

CVE-2026-15779: Samba pam_winbind denial of service via root directory chown

CVE-2026-15779 · Severity: medium · CVSS 6.1 · Published 2026-07-15

Technologies: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Samba. Vendors: Red Hat, Samba.

Executive brief

A vulnerability in the Samba winbind component can allow a local user to cause a severe system-wide outage. By triggering a specific home-directory creation feature, the system may incorrectly change the ownership of the root directory to a non-privileged account. This breaks critical security checks for services like SSH and sudo, effectively locking users out of the system and disrupting administrative operations.

Technical details

A flaw exists in the pam_winbind module's _pam_mkhomedir() and _pam_chown_homedir() functions. When 'mkhomedir = yes' is configured, the module calls chown() on the target user's home directory path (retrieved via getpwnam) without validating that the path is not a critical system directory. On many Linux distributions, system accounts (like 'nobody') have '/' defined as their home directory. A local attacker with even narrow sudo permissions to run commands as such an account can trigger this code path, causing the ownership of '/' to change. While this does not grant write access to the root directory due to restrictive 0555 permissions on RHEL, it causes immediate failures in SSH (StrictModes), sudo, and package managers that enforce ownership checks on the root filesystem. The issue is fixed in Samba 4.24.3 and later, where chown() is only called if a new directory is created.

Affected products

  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 10
  • Samba Samba 4.19.x, 4.23.x

Timeline

  • 2026-07-14: disclosed: Reported via OSIDB/Bugzilla
  • 2026-07-15: advisory: CVE-2026-15779 published
  • 2026-07-28: patched: Fix scheduled for RHEL 8.10.z via RHBA-2026:169544

References

Related threats