CVE-2026-58218: Samba internal DNS server denial of service via TKEY cache exhaustion

CVE-2026-58218 · Severity: medium · CVSS 5.3 · Published 2026-07-30

A vulnerability in Samba's internal DNS server allows an unauthenticated remote attacker to disrupt secure network communications. By flooding the server with specific types of requests, an attacker can exhaust a small internal cache, causing the server to drop legitimate security keys used for signed DNS queries. This results in a denial of service where authorized users and systems may be unable to perform secure DNS updates or lookups, potentially impacting the stability of an Active Directory domain.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Samba. Vendors: Red Hat, Samba.

Quick answers

Is CVE-2026-58218 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58218 being exploited in the wild.
How severe is CVE-2026-58218?
Medium severity, with a CVSS score of 5.3, published 30 July 2026.
Which products and versions are affected?
Red Hat Enterprise Linux 10 samba; Red Hat Enterprise Linux 6 samba, samba4; Red Hat Enterprise Linux 7 samba; Red Hat Enterprise Linux 8 samba; and 3 more.
Is there a fix for CVE-2026-58218?
A patch was published on 2026-07-29: Samba bug resolved and fixed status updated Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58218 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-58218?
Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability exists in Samba's internal DNS server (source4/dns_server). The server processes TKEY registration requests by allocating GENSEC state and inserting the key into a fixed-size 128-entry FIFO buffer before completing authentication. An unauthenticated remote attacker can send a flood of TKEY queries with unique names and invalid GSS tokens to fill this buffer, evicting legitimate TSIG session keys. This prevents successful TSIG authentication for signed DNS queries and updates. The vulnerability affects all Samba versions since 4.0. A patch is available that delays FIFO insertion until authentication is successful or requires continuation.

Affected products

  • Samba Samba 4.0 and newer
  • Red Hat Enterprise Linux 6 samba, samba4
  • Red Hat Enterprise Linux 7 samba
  • Red Hat Enterprise Linux 8 samba
  • Red Hat Enterprise Linux 9 samba
  • Red Hat Enterprise Linux 10 samba
  • Red Hat OpenShift Container Platform 4 rhcos

Timeline

  • 2026-06-14: disclosed: Initial report by Andrew Tridgell
  • 2026-07-30: advisory: NVD and Red Hat published advisory details
  • 2026-07-29: patched: Samba bug resolved and fixed status updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.