An update for samba is now available for openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3297 Final 1.0 1.0 2026-08-07 Initial 2026-08-07 2026-08-07 openEuler SA Tool V1.0 2026-08-07 samba security update An update for samba is now available for openEuler-20.03-LTS-SP4 Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fix(es): An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.(CVE-2026-58216) A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.(CVE-2026-58218) Samba is an open-source implementation of file sharing and printing services for communication between Linux/Unix and Windows systems. CVE-2026-58221 is a security vulnerability in Samba affecting versions before 4.22.10.(CVE-2026-58221) A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.(CVE-2026-58222) An undisclosed vulnerability exists in Samba affecting versions before 4.22.10.(CVE-2026-58224) A security vulnerability exists in Samba affecting versions before 4.22.10. The specific vulnerability details have not been publicly disclosed.(CVE-2026-6949) An update for samba is now available for openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High samba https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3297 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-58216 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-58218 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-58221 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-58222 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-58224 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-6949 https://nvd.nist.gov/vuln/detail/CVE-2026-58216 https://nvd.nist.gov/vuln/detail/CVE-2026-58218 https://nvd.nist.gov/vuln/detail/CVE-2026-58221 https://nvd.nist.gov/vuln/detail/CVE-2026-58222 https://nvd.nist.gov/vuln/detail/CVE-2026-58224 https://nvd.nist.gov/vuln/detail/CVE-2026-6949 openEuler-20.03-LTS-SP4 samba-4.11.12-39.oe2003sp4.src.rpm samba-pidl-4.11.12-39.oe2003sp4.noarch.rpm ctdb-4.11.12-39.oe2003sp4.aarch64.rpm ctdb-tests-4.11.12-39.oe2003sp4.aarch64.rpm libsmbclient-4.11.12-39.oe2003sp4.aarch64.rpm libsmbclient-devel-4.11.12-39.oe2003sp4.aarch64.rpm libwbclient-4.11.12-39.oe2003sp4.aarch64.rpm libwbclient-devel-4.11.12-39.oe2003sp4.aarch64.rpm python3-samba-4.11.12-39.oe2003sp4.aarch64.rpm python3-samba-dc-4.11.12-39.oe2003sp4.aarch64.rpm python3-samba-test-4.11.12-39.oe2003sp4.aarch64.rpm samba-4.11.12-39.oe2003sp4.aarch64.rpm samba-client-4.11.12-39.oe2003sp4.aarch64.rpm samba-common-4.11.12-39.oe2003sp4.aarch64.rpm samba-common-tools-4.11.12-39.oe2003sp4.aarch64.rpm samba-dc-4.11.12-39.oe2003sp4.aarch64.rpm samba-dc-bind-dlz-4.11.12-39.oe2003sp4.aarch64.rpm samba-dc-provision-4.11.12-39.oe2003sp4.aarch64.rpm samba-debuginfo-4.11.12-39.oe2003sp4.aarch64.rpm samba-debugsource-4.11.12-39.oe2003sp4.aarch64.rpm samba-devel-4.11.12-39.oe2003sp4.aarch64.rpm samba-help-4.11.12-39.oe2003sp4.aarch64.rpm samba-krb5-printing-4.11.12-39.oe2003sp4.aarch64.rpm samba-libs-4.11.12-39.oe2003sp4.aarch64.rpm samba-test-4.11.12-39.oe2003sp4.aarch64.rpm samba-winbind-4.11.12-39.oe2003sp4.aarch64.rpm samba-winbind-clients-4.11.12-39.oe2003sp4.aarch64.rpm samba-winbind-krb5-locator-4.11.12-39.oe2003sp4.aarch64.rpm samba-winbind-modules-4.11.12-39.oe2003sp4.aarch64.rpm ctdb-4.11.12-39.oe2003sp4.x86_64.rpm ctdb-tests-4.11.12-39.oe2003sp4.x86_64.rpm libsmbclient-4.11.12-39.oe2003sp4.x86_64.rpm libsmbclient-devel-4.11.12-39.oe2003sp4.x86_64.rpm libwbclient-4.11.12-39.oe2003sp4.x86_64.rpm libwbclient-devel-4.11.12-39.oe2003sp4.x86_64.rpm python3-samba-4.11.12-39.oe2003sp4.x86_64.rpm python3-samba-dc-4.11.12-39.oe2003sp4.x86_64.rpm python3-samba-test-4.11.12-39.oe2003sp4.x86_64.rpm samba-4.11.12-39.oe2003sp4.x86_64.rpm samba-client-4.11.12-39.oe2003sp4.x86_64.rpm samba-common-4.11.12-39.oe2003sp4.x86_64.rpm samba-common-tools-4.11.12-39.oe2003sp4.x86_64.rpm samba-dc-4.11.12-39.oe2003sp4.x86_64.rpm samba-dc-bind-dlz-4.11.12-39.oe2003sp4.x86_64.rpm samba-dc-provision-4.11.12-39.oe2003sp4.x86_64.rpm samba-debuginfo-4.11.12-39.oe2003sp4.x86_64.rpm samba-debugsource-4.11.12-39.oe2003sp4.x86_64.rpm samba-devel-4.11.12-39.oe2003sp4.x86_64.rpm samba-help-4.11.12-39.oe2003sp4.x86_64.rpm samba-krb5-printing-4.11.12-39.oe2003sp4.x86_64.rpm samba-libs-4.11.12-39.oe2003sp4.x86_64.rpm samba-test-4.11.12-39.oe2003sp4.x86_64.rpm samba-vfs-glusterfs-4.11.12-39.oe2003sp4.x86_64.rpm samba-winbind-4.11.12-39.oe2003sp4.x86_64.rpm samba-winbind-clients-4.11.12-39.oe2003sp4.x86_64.rpm samba-winbind-krb5-locator-4.11.12-39.oe2003sp4.x86_64.rpm samba-winbind-modules-4.11.12-39.oe2003sp4.x86_64.rpm An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service. 2026-08-07 CVE-2026-58216 openEuler-20.03-LTS-SP4 Medium 5.3 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H samba security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3297 A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service. 2026-08-07 CVE-2026-58218 openEuler-20.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L samba security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3297 Samba is an open-source implementation of file sharing and printing services for communication between Linux/Unix and Windows systems. CVE-2026-58221 is a security vulnerability in Samba affecting versions before 4.22.10. 2026-08-07 CVE-2026-58221 openEuler-20.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H samba security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3297 A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present. 2026-08-07 CVE-2026-58222 openEuler-20.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H samba security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3297 An undisclosed vulnerability exists in Samba affecting versions before 4.22.10. 2026-08-07 CVE-2026-58224 openEuler-20.03-LTS-SP4 High 7.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H samba security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3297 A security vulnerability exists in Samba affecting versions before 4.22.10. The specific vulnerability details have not been publicly disclosed. 2026-08-07 CVE-2026-6949 openEuler-20.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N samba security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3297