Samba's July batch: one domain-takeover bug hiding behind a pile of DoS

Ubuntu and Debian both shipped a Samba fix on 28 July 2026 — USN-8621-1 on the Ubuntu side, DSA-6401-1 on Debian's. It's a fat advisory: eight CVEs in one go. But counting CVEs is the wrong way to read it. Seven of the eight are denial-of-service, and exactly one of them is the reason you should stop reading and go patch.

The one that actually matters

That one is CVE-2026-58221. Per Ubuntu's write-up, Samba mishandled internal LDB special directory names while processing authenticated LDAP requests, and an authenticated user "could possibly use this issue to perform unauthorized modifications and gain control of a domain." Control of a domain. That is not a crash you restart out of — that is a privilege-escalation-to-domain-admin bug reachable by anyone who can already bind to your directory. If you run Samba as an Active Directory domain controller, treat this as the headline and everything else as bycatch.

Right behind it, CVE-2026-58222 lets an authenticated user leak information through malformed LDAP Compare requests. Lower stakes, same precondition: it needs a directory to talk to.

Everything else is a crash

The rest is denial-of-service, and the distinction between them is really what part of the AD DC you can knock over:

• CVE-2026-6949 — TSIG packets with name compression crash Samba's DNS. Remote, unauthenticated.
• CVE-2026-58218 — TKEY name registration can exhaust the name cache. Remote.
• CVE-2026-58216 — malformed ASN.1 kpasswd packets crash the KDC. Needs an authenticated user.
• CVE-2026-58224 — the CTDB clustering protocol had insufficient bounds checking, so a remote attacker can crash it.
• CVE-2026-15779 — the pam_winbind one: with mkhomedir enabled, home-directory ownership was handled wrongly and a local attacker could trigger a change of ownership on the root directory.

What this means if you run mail, not a domain

Here's the part the advisories don't spell out, because they describe the package and not your deployment. Almost all of the serious CVEs — the domain takeover, the LDAP compare leak, the TSIG and TKEY DNS crashes, kpasswd, CTDB — require the Active Directory DC role to be running. If your Samba is a plain file server exporting SMB shares (say, a mail spool sitting on a NAS, or shared storage between front-ends), the AD DC surface simply isn't listening, and those bugs don't describe your box. That's not permission to skip the update; it's permission to not panic at 2am.

The exception is CVE-2026-15779, the pam_winbind bug, because that one lives wherever you use winbind for authentication. Plenty of mail setups authenticate against AD through winbind rather than talking LDAP directly, and if you've turned on mkhomedir so users get a home directory created on first login, this is your risk. It's local and it's DoS, not takeover — but a root-directory ownership flip is the kind of thing that quietly breaks a server until someone notices nothing works.

If you're on iRedMail or a Postfix/Dovecot stack that authenticates against your own OpenLDAP or a SQL backend, none of this is your Samba — you probably don't run Samba as a DC at all, and the winbind path doesn't apply either. Check what's actually installed before you assume you're exposed.

Patching

Ubuntu's guidance is the usual: "a standard system update will make all the necessary changes." The fixed source package is 2:4.23.6+dfsg-1ubuntu2.2 on 26.04, 2:4.19.5+dfsg-4ubuntu9.7 on 24.04, and 2:4.15.13+dfsg-0ubuntu1.13 on 22.04. Debian's DSA-6401-1 covers the same set of CVEs; I couldn't retrieve its body, so check the tracker linked from the advisory for the exact Debian package version before you deploy. As always with a DC, watch for a service restart — winbind, smbd and the samba AD DC process want to come back cleanly after the upgrade.

Sources

• Ubuntu Security Notices — USN-8621-1
• Debian Security Advisories — DSA-6401-1