Samba's July batch: one domain-takeover bug hiding behind a pile of DoS
Ubuntu and Debian both shipped a Samba fix on 28 July 2026 — USN-8621-1 on the Ubuntu side, DSA-6401-1 on Debian's. It's a fat advisory: eight CVEs in one go. But counting CVEs is the wrong way to read it. Seven of the eight are denial-of-service, and exactly one of them is the reason you should stop reading and go patch.
The one that actually matters
That one is CVE-2026-58221. Per Ubuntu's write-up, Samba mishandled internal LDB special directory names while processing authenticated LDAP requests, and an authenticated user "could possibly use this issue to perform unauthorized modifications and gain control of a domain." Control of a domain. That is not a crash you restart out of — that is a privilege-escalation-to-domain-admin bug reachable by anyone who can already bind to your directory. If you run Samba as an Active Directory domain controller, treat this as the headline and everything else as bycatch.
Right behind it, CVE-2026-58222 lets an authenticated user leak information through malformed LDAP Compare requests. Lower stakes, same precondition: it needs a directory to talk to.
Everything else is a crash
The rest is denial-of-service, and the distinction between them is really what part of the AD DC you can knock over:
- CVE-2026-6949 — TSIG packets with name compression crash Samba's DNS. Remote, unauthenticated.
- CVE-2026-58218 — TKEY name registration can exhaust the name cache. Remote.
- CVE-2026-58216 — malformed ASN.1 kpasswd packets crash the KDC. Needs an authenticated user.
- CVE-2026-58224 — the CTDB clustering protocol had insufficient bounds checking, so a remote attacker can crash it.
- CVE-2026-15779 — the pam_winbind one: with
mkhomedirenabled, home-directory ownership was handled wrongly and a local attacker could trigger a change of ownership on the root directory.
What this means if you run mail, not a domain
Here's the part the advisories don't spell out, because they describe the package and not your deployment. Almost all of the serious CVEs — the domain takeover, the LDAP compare leak, the TSIG and TKEY DNS crashes, kpasswd, CTDB — require the Active Directory DC role to be running. If your Samba is a plain file server exporting SMB shares (say, a mail spool sitting on a NAS, or shared storage between front-ends), the AD DC surface simply isn't listening, and those bugs don't describe your box. That's not permission to skip the update; it's permission to not panic at 2am.
The exception is CVE-2026-15779, the pam_winbind bug, because that one lives wherever you use winbind for authentication. Plenty of mail setups authenticate against AD through winbind rather than talking LDAP directly, and if you've turned on mkhomedir so users get a home directory created on first login, this is your risk. It's local and it's DoS, not takeover — but a root-directory ownership flip is the kind of thing that quietly breaks a server until someone notices nothing works.
If you're on iRedMail or a Postfix/Dovecot stack that authenticates against your own OpenLDAP or a SQL backend, none of this is your Samba — you probably don't run Samba as a DC at all, and the winbind path doesn't apply either. Check what's actually installed before you assume you're exposed.
Patching
Ubuntu's guidance is the usual: "a standard system update will make all the necessary changes." The fixed source package is 2:4.23.6+dfsg-1ubuntu2.2 on 26.04, 2:4.19.5+dfsg-4ubuntu9.7 on 24.04, and 2:4.15.13+dfsg-0ubuntu1.13 on 22.04. Debian's DSA-6401-1 covers the same set of CVEs; I couldn't retrieve its body, so check the tracker linked from the advisory for the exact Debian package version before you deploy. As always with a DC, watch for a service restart — winbind, smbd and the samba AD DC process want to come back cleanly after the upgrade.
Sources
Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
More about the author →Was this article helpful?
Tap a star — no sign-in needed.
Be the first to rate this article.
Related guides
SharePoint's JWT Bypass, and Why the UPN Prerequisite Is Barely a Speed Bump
If you run an on-premises Microsoft stack, SharePoint usually isn't the box you think about first — it sits next to Exchange, shares the same Active Directory, and gets patched on whatever cadence the Windows team keeps. This one is worth pulling forward, and not for the reason the headline gives.
A Gitea Code-Injection Bug Is Being Exploited — Patch, Then Assume the Worst
CISA added CVE-2026-60004 , described as a Gitea code injection vulnerability, to its Known Exploited Vulnerabilities catalog on 25 August 2026. The KEV listing is the important part: CISA doesn't add things to that catalog on theory. It adds them when there's evidence of active exploitation in the wild. So this isn't "a bug was disclosed" — it's "somebody is using this against real servers right now."
Validate and Auto-Correct DMARC Records Across Domains
This guide builds a Python tool that looks up the _dmarc.<domain> TXT record for one or more domains, parses it, and reports where the DMARC policy is missing, malformed, or weaker than the baseline you set. In its default form it only reads DNS — it changes nothing. The optional second half pushes a corrected record through a DNS provider API (I use Cloudflare as the concrete example).
OVSwrap (CVE-2026-64531): a local-root kernel bug hiding in a very large patch wave
On 21 August 2026 Canonical pushed out a broad set of kernel security notices, and threaded through most of them is one identifier: CVE-2026-64531 , nicknamed OVSwrap , an Open vSwitch flaw in the Linux kernel that leads to local root. The oss-security post that carries the name declines AI crawlers , so I only have its subject line to confirm the classification — Linux kernel / OVS, local privilege escalation. The details of the write-up I can't quote, and won't guess at.