Description
A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation "classic DCs") can erroneously start and compete for the same unix domain sockets. This issue leads to partial query responses from the AD DC, causing issues such as "The procedure number is out of range" when using tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | samba | 4.16.0 – < 4.17.12, 4.18.0 – < 4.18.8, 4.19.0 | 4.17.12 |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Storage 3 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 2:4.19.1+dfsg-1 | — |
| Debian 13 | samba | 2:4.19.1+dfsg-1 | — |
| Debian 12 | samba | 2:4.17.12+dfsg-0+deb12u1 | DSA-5525-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | samba | 2:4.15.13+dfsg-0ubuntu1.5 | USN-6425-1 |
| Ubuntu 20.04 LTS | samba | 2:4.15.13+dfsg-0ubuntu0.20.04.6 | USN-6425-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | samba | 4.17.9+git.421.abde31ca5c2-150500.3.11.1 | SUSE-SU-2023:4046-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.5 | samba | 4.17.9+git.421.abde31ca5c2-150500.3.11.1 | SUSE-SU-2023:4046-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | samba | 4.19.1+git.312.c912b3d2ef6-1.1 | openSUSE-SU-2024:13332-1 |
| openSUSE Leap 15.5 | samba | 4.17.9+git.421.abde31ca5c2-150500.3.11.1 | SUSE-SU-2023:4046-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | samba | 4.18.8-r0 | — |
| Alpine v3.23 | samba | 4.18.8-r0 | — |
| Alpine v3.22 | samba | 4.18.8-r0 | — |
| Alpine v3.21 | samba | 4.18.8-r0 | — |
| Alpine v3.20 | samba | 4.18.8-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | samba | 4.18.8-r0 | — |
| Alpine v3.18 | samba | 4.18.8-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | samba | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | samba | No fix yet | — |
Advisories 8
- USN-6425-1 samba vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5525-1 samba - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:13332-1 ctdb-4.19.1+git.312.c912b3d2ef6-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2026-0031 Kwetsbaarheden verholpen in Oracle JD Edwards NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0169 Oracle JD Edwards: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- SUSE-SU-2023:4046-1 Security update for samba SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2023-2620 Samba: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 9, 2025
- WID-SEC-2024-0523 SolarWinds Security Event Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024