DEBIAN-CVE-2026-15779

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-15779

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-15779.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-15779

Upstream

CVE-2026-15779

Published

2026-07-15T13:17:03Z

Modified

2026-09-14T17:02:31Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVSS Calculator

Summary

[none]

Details

A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.

References

https://security-tracker.debian.org/tracker/CVE-2026-15779

Affected packages

Debian:12 / samba

Package

Name: samba
Purl: pkg:deb/debian/samba?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2:4.*

2:4.17.8+dfsg-2

2:4.17.8+dfsg-2.1

2:4.17.9+dfsg-0+deb12u1

2:4.17.9+dfsg-0+deb12u2

2:4.17.9+dfsg-0+deb12u3~bpo11+1

2:4.17.9+dfsg-0+deb12u3

2:4.17.10+dfsg-0+deb12u1~bpo11+1

2:4.17.10+dfsg-0+deb12u1

2:4.17.11+dfsg-0+deb12u1

2:4.17.12+dfsg-0+deb12u1~bpo11+1

2:4.17.12+dfsg-0+deb12u1

2:4.17.12+dfsg-0+deb12u2

2:4.17.12+dfsg-0+deb12u3

2:4.17.12+dfsg-0+deb12u4

2:4.18.0~rc1+dfsg-1exp

2:4.18.0~rc2+dfsg-1

2:4.18.0~rc3+dfsg-1

2:4.18.0~rc4+dfsg-1

2:4.18.0+dfsg-1~exp1

2:4.18.1+dfsg-1~exp1

2:4.18.2+dfsg-1

2:4.18.3+dfsg-1

2:4.18.3+dfsg-2

2:4.18.3+dfsg-3

2:4.18.4+dfsg-1

2:4.18.4+dfsg-2~bpo12+1

2:4.18.4+dfsg-2

2:4.18.5+dfsg-1

2:4.18.5+dfsg-2~bpo12+1

2:4.18.5+dfsg-2

2:4.18.6+dfsg-1~bpo12+1

2:4.18.6+dfsg-1

2:4.18.8+dfsg-1~bpo12+1

2:4.19.0~rc1+dfsg-1

2:4.19.0~rc1+dfsg-2

2:4.19.0~rc1+dfsg-3

2:4.19.0~rc2+dfsg-1

2:4.19.0~rc4+dfsg-1

2:4.19.0~rc4+dfsg-2

2:4.19.0+dfsg-1

2:4.19.1+dfsg-1

2:4.19.1+dfsg-2

2:4.19.1+dfsg-3

2:4.19.1+dfsg-4

2:4.19.2+dfsg-1

2:4.19.3+dfsg-1~bpo12+1

2:4.19.3+dfsg-1

2:4.19.3+dfsg-2

2:4.19.4+dfsg-1

2:4.19.4+dfsg-2~bpo12+1

2:4.19.4+dfsg-2

2:4.19.4+dfsg-3~bpo12+1

2:4.19.4+dfsg-3

2:4.19.5+dfsg-1

2:4.19.5+dfsg-2

2:4.19.5+dfsg-3

2:4.19.5+dfsg-4~bpo12+1

2:4.19.5+dfsg-4

2:4.19.5+dfsg-5

2:4.19.6+dfsg-1

2:4.19.6+dfsg-2

2:4.19.6+dfsg-3~bpo12+1

2:4.19.6+dfsg-3

2:4.20.0~rc1+dfsg-1

2:4.20.0~rc2+dfsg-1

2:4.20.0~rc2+dfsg-2

2:4.20.0~rc2+dfsg-3

2:4.20.0+dfsg-1~exp1

2:4.20.0+dfsg-1~exp2

2:4.20.1+dfsg-1

2:4.20.1+dfsg-2

2:4.20.1+dfsg-3

2:4.20.1+dfsg-4~bpo12+1

2:4.20.1+dfsg-4

2:4.20.1+dfsg-5

2:4.20.2+dfsg-1

2:4.20.2+dfsg-2~bpo12+1

2:4.20.2+dfsg-2~bpo12+2

2:4.20.2+dfsg-2

2:4.20.2+dfsg-3

2:4.20.2+dfsg-4

2:4.20.2+dfsg-5~bpo12+1

2:4.20.2+dfsg-5

2:4.20.2+dfsg-6~bpo12+1

2:4.20.2+dfsg-6

2:4.20.2+dfsg-7

2:4.20.2+dfsg-8

2:4.20.2+dfsg-9~exp1

2:4.20.2+dfsg-9~exp2

2:4.20.2+dfsg-9

2:4.20.2+dfsg-10

2:4.20.4+dfsg-1~bpo12+1

2:4.20.5+dfsg-1~bpo12+1

2:4.21.0~rc1+dfsg-1

2:4.21.0~rc1+really4.20.2+dfsg-11

2:4.21.0~rc1+really4.20.2+dfsg-11r

2:4.21.0~rc1+really4.20.3+dfsg-1

2:4.21.0~rc1+really4.20.4+dfsg-1

2:4.21.0~rc2+dfsg-1

2:4.21.0+dfsg-1

2:4.21.1+dfsg-1~bpo12+1

2:4.21.1+dfsg-1

2:4.21.1+dfsg-2~bpo12+1

2:4.21.1+dfsg-2

2:4.21.1+dfsg-2+hurd.1

2:4.21.2+dfsg-1

2:4.21.2+dfsg-2

2:4.21.2+dfsg-3~bpo12+1

2:4.21.2+dfsg-3

2:4.21.2+dfsg-4~exp1

2:4.21.2+dfsg-4

2:4.21.2+dfsg-4+hurd.1

2:4.21.3+dfsg-1~bpo12+1

2:4.21.3+dfsg-1

2:4.21.3+dfsg-2

2:4.21.3+dfsg-3

2:4.21.3+dfsg-4~bpo12+1

2:4.21.3+dfsg-4

2:4.21.3+dfsg-5~bpo12+1

2:4.21.3+dfsg-5

2:4.21.3+dfsg-6~bpo12+1

2:4.21.3+dfsg-6

2:4.21.4+dfsg-1~bpo12+1

2:4.21.4+dfsg-1

2:4.21.5+dfsg-1~bpo12+1

2:4.22.0~rc1+dfsg-1

2:4.22.0+dfsg-1

2:4.22.0+dfsg-2

2:4.22.0+dfsg-3

2:4.22.1+dfsg-1~bpo12+1

2:4.22.1+dfsg-1

2:4.22.2+dfsg-1~bpo12+1

2:4.22.2+dfsg-1

2:4.22.3+dfsg-1

2:4.22.3+dfsg-2~bpo12+1

2:4.22.3+dfsg-2

2:4.22.3+dfsg-3

2:4.22.3+dfsg-4~bpo12+1

2:4.22.3+dfsg-4

2:4.22.4+dfsg-1~deb13u1~bpo12+1

2:4.22.4+dfsg-1~deb13u1

2:4.22.4+dfsg-1

2:4.23.0~rc1+dfsg-1

2:4.23.0~rc2+dfsg-1

2:4.23.0~rc3+dfsg-1

2:4.23.0+dfsg-1

2:4.23.0+dfsg-2

2:4.23.0+dfsg-3

2:4.23.1+dfsg-1

2:4.23.2+dfsg-1

2:4.23.3+dfsg-1~bpo13+1

2:4.23.3+dfsg-1

2:4.23.4+dfsg-1~bpo13+1

2:4.23.4+dfsg-1

2:4.23.5+dfsg-1~bpo13+1

2:4.23.5+dfsg-1

2:4.23.6+dfsg-1

2:4.23.6+dfsg-2~bpo13+1

2:4.23.6+dfsg-2

2:4.24.0~rc1+dfsg-1

2:4.24.0~rc1+dfsg-2

2:4.24.0~rc1+dfsg-3

2:4.24.0~rc2+dfsg-1

2:4.24.0+dfsg-1

2:4.24.1+dfsg-1

2:4.24.2+dfsg-1~bpo13+1

2:4.24.2+dfsg-1

2:4.24.3+dfsg-1~bpo13+1

2:4.24.3+dfsg-1

2:4.24.4+dfsg-1~bpo13+1

2:4.24.4+dfsg-1

2:4.24.5+dfsg-1~bpo13+1

2:4.24.5+dfsg-1

2:4.24.6+dfsg-1

2:4.24.7+dfsg-1~bpo13+1

2:4.24.7+dfsg-1

2:4.25.0~rc1+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-15779.json"

Debian:13 / samba

Package

Name: samba
Purl: pkg:deb/debian/samba?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2:4.*

2:4.22.3+dfsg-4

2:4.22.4+dfsg-1~deb13u1~bpo12+1

2:4.22.4+dfsg-1~deb13u1

2:4.22.4+dfsg-1

2:4.22.6+dfsg-0+deb13u1~bpo12+1

2:4.22.6+dfsg-0+deb13u1

2:4.22.8+dfsg-0+deb13u1

2:4.22.8+dfsg-0+deb13u2

2:4.22.10+dfsg-0+deb13u1

2:4.22.10+dfsg-0+deb13u2

2:4.22.11+dfsg-0+deb13u1

2:4.23.0~rc1+dfsg-1

2:4.23.0~rc2+dfsg-1

2:4.23.0~rc3+dfsg-1

2:4.23.0+dfsg-1

2:4.23.0+dfsg-2

2:4.23.0+dfsg-3

2:4.23.1+dfsg-1

2:4.23.2+dfsg-1

2:4.23.3+dfsg-1~bpo13+1

2:4.23.3+dfsg-1

2:4.23.4+dfsg-1~bpo13+1

2:4.23.4+dfsg-1

2:4.23.5+dfsg-1~bpo13+1

2:4.23.5+dfsg-1

2:4.23.6+dfsg-1

2:4.23.6+dfsg-2~bpo13+1

2:4.23.6+dfsg-2

2:4.24.0~rc1+dfsg-1

2:4.24.0~rc1+dfsg-2

2:4.24.0~rc1+dfsg-3

2:4.24.0~rc2+dfsg-1

2:4.24.0+dfsg-1

2:4.24.1+dfsg-1

2:4.24.2+dfsg-1~bpo13+1

2:4.24.2+dfsg-1

2:4.24.3+dfsg-1~bpo13+1

2:4.24.3+dfsg-1

2:4.24.4+dfsg-1~bpo13+1

2:4.24.4+dfsg-1

2:4.24.5+dfsg-1~bpo13+1

2:4.24.5+dfsg-1

2:4.24.6+dfsg-1

2:4.24.7+dfsg-1~bpo13+1

2:4.24.7+dfsg-1

2:4.25.0~rc1+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-15779.json"

Debian:14 / samba

Package

Name: samba
Purl: pkg:deb/debian/samba?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2:4.*

2:4.22.3+dfsg-4

2:4.22.4+dfsg-1~deb13u1~bpo12+1

2:4.22.4+dfsg-1~deb13u1

2:4.22.4+dfsg-1

2:4.23.0~rc1+dfsg-1

2:4.23.0~rc2+dfsg-1

2:4.23.0~rc3+dfsg-1

2:4.23.0+dfsg-1

2:4.23.0+dfsg-2

2:4.23.0+dfsg-3

2:4.23.1+dfsg-1

2:4.23.2+dfsg-1

2:4.23.3+dfsg-1~bpo13+1

2:4.23.3+dfsg-1

2:4.23.4+dfsg-1~bpo13+1

2:4.23.4+dfsg-1

2:4.23.5+dfsg-1~bpo13+1

2:4.23.5+dfsg-1

2:4.23.6+dfsg-1

2:4.23.6+dfsg-2~bpo13+1

2:4.23.6+dfsg-2

2:4.24.0~rc1+dfsg-1

2:4.24.0~rc1+dfsg-2

2:4.24.0~rc1+dfsg-3

2:4.24.0~rc2+dfsg-1

2:4.24.0+dfsg-1

2:4.24.1+dfsg-1

2:4.24.2+dfsg-1~bpo13+1

2:4.24.2+dfsg-1

2:4.24.3+dfsg-1~bpo13+1

2:4.24.3+dfsg-1

2:4.24.4+dfsg-1~bpo13+1

2:4.24.4+dfsg-1

2:4.24.5+dfsg-1~bpo13+1

2:4.24.5+dfsg-1

2:4.24.6+dfsg-1

2:4.24.7+dfsg-1~bpo13+1

2:4.24.7+dfsg-1

2:4.25.0~rc1+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-15779.json"