Executive brief
A vulnerability in Samba's internal DNS server allows an unauthenticated remote attacker to disrupt secure network communications. By flooding the server with specific types of requests, an attacker can exhaust a small internal cache, causing the server to drop legitimate security keys used for signed DNS queries. This results in a denial of service where authorized users and systems may be unable to perform secure DNS updates or lookups, potentially impacting the stability of an Active Directory domain.
Technical details
A resource exhaustion vulnerability exists in Samba's internal DNS server (source4/dns_server). The server processes TKEY registration requests by allocating GENSEC state and inserting the key into a fixed-size 128-entry FIFO buffer before completing authentication. An unauthenticated remote attacker can send a flood of TKEY queries with unique names and invalid GSS tokens to fill this buffer, evicting legitimate TSIG session keys. This prevents successful TSIG authentication for signed DNS queries and updates. The vulnerability affects all Samba versions since 4.0. A patch is available that delays FIFO insertion until authentication is successful or requires continuation.
Affected products
- Samba Samba 4.0 and newer
- Red Hat Enterprise Linux 6 samba, samba4
- Red Hat Enterprise Linux 7 samba
- Red Hat Enterprise Linux 8 samba
- Red Hat Enterprise Linux 9 samba
- Red Hat Enterprise Linux 10 samba
- Red Hat OpenShift Container Platform 4 rhcos
Timeline
- 2026-06-14: disclosed: Initial report by Andrew Tridgell
- 2026-07-30: advisory: NVD and Red Hat published advisory details
- 2026-07-29: patched: Samba bug resolved and fixed status updated