CVE-2026-15779
Publication date 15 July 2026
Last updated 6 August 2026
Ubuntu priority
Description
A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| samba | 26.04 LTS resolute |
Fixed 2:4.23.6+dfsg-1ubuntu2.2
|
| 24.04 LTS noble |
Fixed 2:4.19.5+dfsg-4ubuntu9.7
|
|
| 22.04 LTS jammy |
Fixed 2:4.15.13+dfsg-0ubuntu1.13
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
Patch details
| Package | Patch details |
|---|---|
| samba |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
6.1 · Medium
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8621-1
- Samba vulnerabilities
- 28 July 2026