# CVE-2026-15779: Samba pam_winbind denial of service via root directory chown

Source: https://junglewise.ai/threats/cve-2026-15779-samba-pam-winbind-denial-of-service-via-root-directory-chown  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-15779 · Severity: medium · CVSS 6.1 · Published 2026-07-15

A vulnerability in the Samba winbind component can allow a local user to cause a severe system-wide outage. By triggering a specific home-directory creation feature, the system may incorrectly change the ownership of the root directory to a non-privileged account. This breaks critical security checks for services like SSH and sudo, effectively locking users out of the system and disrupting administrative operations.

Technologies: [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10), [Red Hat Enterprise Linux 7](https://junglewise.ai/threats/technologies/enterprise-linux-7), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9), [Samba](https://junglewise.ai/threats/technologies/samba). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat), [Samba](https://junglewise.ai/threats/vendors/samba).

## Quick answers

**Is CVE-2026-15779 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15779 being exploited in the wild.

**How severe is CVE-2026-15779?** Medium severity, with a CVSS score of 6.1, published 15 July 2026.

**Which products and versions are affected?** Samba 4.19.x, 4.23.x.

**Is there a fix for CVE-2026-15779?** A patch was published on 2026-07-28: Fix scheduled for RHEL 8.10.z via RHBA-2026:169544 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15779 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-15779?** Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A flaw exists in the pam_winbind module's _pam_mkhomedir() and _pam_chown_homedir() functions. When 'mkhomedir = yes' is configured, the module calls chown() on the target user's home directory path (retrieved via getpwnam) without validating that the path is not a critical system directory. On many Linux distributions, system accounts (like 'nobody') have '/' defined as their home directory. A local attacker with even narrow sudo permissions to run commands as such an account can trigger this code path, causing the ownership of '/' to change. While this does not grant write access to the root directory due to restrictive 0555 permissions on RHEL, it causes immediate failures in SSH (StrictModes), sudo, and package managers that enforce ownership checks on the root filesystem. The issue is fixed in Samba 4.24.3 and later, where chown() is only called if a new directory is created.

## Affected products

- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
- Samba Samba 4.19.x, 4.23.x

## Timeline

- 2026-07-14: disclosed: Reported via OSIDB/Bugzilla
- 2026-07-15: advisory: CVE-2026-15779 published
- 2026-07-28: patched: Fix scheduled for RHEL 8.10.z via RHBA-2026:169544

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-15779](https://access.redhat.com/security/cve/CVE-2026-15779)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2499991](https://bugzilla.redhat.com/show_bug.cgi?id=2499991)
- [https://gitlab.com/samba-team/samba/-/blob/samba-4.19.4/nsswitch/pam_winbind.c](https://gitlab.com/samba-team/samba/-/blob/samba-4.19.4/nsswitch/pam_winbind.c)
- [https://gitlab.com/samba-team/samba/-/blob/samba-4.23.5/nsswitch/pam_winbind.c](https://gitlab.com/samba-team/samba/-/blob/samba-4.23.5/nsswitch/pam_winbind.c)
- [https://gitlab.com/samba-team/samba/-/blob/samba-4.24.3/nsswitch/pam_winbind.c](https://gitlab.com/samba-team/samba/-/blob/samba-4.24.3/nsswitch/pam_winbind.c)

## Related threats

- [Samba access control bypass in vfs_ceph_rgw](https://junglewise.ai/threats/cve-2026-109411-an-access-control-bypass-flaw-was-found-in-samba-s-vfs-ceph-rgw)
- [A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of…](https://junglewise.ai/threats/cve-2026-58224-a-flaw-was-found-in-samba-s-ctdb-the-clustered-database-service)
- [Red Hat yggdrasil-worker-package-manager argument injection in APT backend](https://junglewise.ai/threats/cve-2026-18157-red-hat-yggdrasil-worker-package-manager-argument-injection-in)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)