Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6949: TSIG packet with name compression can crash DNS CVE-2026-58218: DNS signing DoS via TKEY name cache exhaustion NOTE: https://www.samba.org/samba/security/CVE-2026-58218-advisory.html CVE-2026-15779: A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.
Fixed packages 55
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libnetapi | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | libnetapi-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | libnetapi-devel | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | libsmbclient | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | libsmbclient-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | libsmbclient-devel | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | libwbclient | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | libwbclient-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | libwbclient-devel | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | python3-samba | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | python3-samba-dc | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | python3-samba-dc-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | python3-samba-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | python3-samba-devel | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | python3-samba-test | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-client | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-client-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-client-libs | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-client-libs-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-common | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-common-libs | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-common-libs-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-common-tools | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-common-tools-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-dc-libs | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-dc-libs-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-dcerpc | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-dcerpc-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-debugsource | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-devel | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-krb5-printing | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-krb5-printing-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-ldb-ldap-modules | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-ldb-ldap-modules-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-libs | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-libs-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-pidl | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-test | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-test-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-test-libs | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-test-libs-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-tools | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-usershares | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-vfs-iouring | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-vfs-iouring-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-winbind | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-winbind-clients | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-winbind-clients-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-winbind-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-winbind-krb5-locator | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-winbind-krb5-locator-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-winbind-modules | 2:4.17.12-1.amzn2023.0.7 |
| Amazon Linux · 2023 | samba-winbind-modules-debuginfo | 2:4.17.12-1.amzn2023.0.7 |
Vulnerabilities 2
-
Medium 6.1
Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation
A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (…
-
Medium 5.3
Samba: dns signing dos via tkey name cache exhaustion
A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests w…