Description
Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration. Additionally, Samba 4.7.12, 4.8.7 and 4.9.3 have been issued as security releases to prevent building of the AD DC with MIT Kerberos unless --with-experimental-mit-ad-dc is specified to the configure command.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | samba | 4.7.12, 4.8.7, 4.9.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 2:4.9.2+dfsg-2 | — |
| Debian 13 | samba | 2:4.9.2+dfsg-2 | — |
| Debian 12 | samba | 2:4.9.2+dfsg-2 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | samba | 4.7.11+git.140.6bd0e5b30d8-4.21.1 | SUSE-SU-2018:4066-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | samba | 4.14.6+git.182.2205d5224e3-1.1 | openSUSE-SU-2024:11365-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | samba | 4.8.7-r0 | — |
| Alpine v3.23 | samba | 4.8.7-r0 | — |
| Alpine v3.22 | samba | 4.8.7-r0 | — |
| Alpine v3.21 | samba | 4.8.7-r0 | — |
| Alpine v3.20 | samba | 4.8.7-r0 | — |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | samba | 4.8.7-r0 | — |
| Alpine v3.18 | samba | 4.8.7-r0 | — |
| Alpine v3.17 | samba | 4.8.7-r0 | — |
| Alpine v3.16 | samba | 4.8.7-r0 | — |
| Alpine v3.15 | samba | 4.8.7-r0 | — |
| Alpine v3.14 | samba | 4.8.7-r0 | — |
| Alpine v3.13 | samba | 4.8.7-r0 | — |
| Alpine v3.12 | samba | 4.8.7-r0 | — |
| Alpine v3.11 | samba | 4.8.7-r0 | — |
| Alpine v3.10 | samba | 4.8.7-r0 | — |
| Alpine v3.9 | samba | 4.8.7-r0 | — |
Advisories 2
- openSUSE-SU-2024:11365-1 ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:4066-1 Security update for samba SUSE / openSUSE Security Updates · Feb 4, 2026