Executive brief
Samba is a widely used suite of programs that allows Linux and Unix systems to share files and printers with Windows systems. A vulnerability in its password change service (kpasswd) could allow a logged-in user to crash the authentication server by sending a specially crafted request. While this does not allow the attacker to steal data, it can disrupt network operations by causing a denial of service.
Technical details
An out-of-bounds read vulnerability exists in Samba's KDC kpasswd service within 'source4/kdc/kpasswd-service.c'. The flaw is caused by a miscalculation of the encrypted data length in ASN.1-encoded Kerberos password change requests, where the code fails to subtract the 6-byte header length from the total packet length. An authenticated attacker can exploit this by sending a malformed request, forcing the server to read up to six bytes beyond the allocated buffer. While this typically results in a decryption failure, it can trigger a process crash (SIGSEGV) if the read crosses into unmapped memory. Fixes are available in Samba security releases, and a workaround exists by disabling the kpasswd service via 'kpasswd port = 0' in smb.conf.
Affected products
- Samba Samba 4.0 and newer
- Red Hat Enterprise Linux 6 samba, samba4
- Red Hat Enterprise Linux 7 samba
- Red Hat Enterprise Linux 8 samba
- Red Hat Enterprise Linux 9 samba
- Red Hat Enterprise Linux 10 samba
- Red Hat OpenShift Container Platform 4 rhcos
Timeline
- 2026-05-27: disclosed: Initial report to Samba by Tristan Madani
- 2026-07-30: advisory: NVD and Red Hat published advisory
- 2026-07-29: patched: Samba bug resolved fixed