Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-14T00:00:00 samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CWE-732

A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.

A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.

Red Hat Product Security rates this flaw's impact as Moderate. Exploitation requires mkhomedir to be explicitly enabled in pam_winbind.conf, a non-default option used specifically in Active Directory domain-integration deployments, and a PAM session to be opened for an account whose home directory resolves to /. While the most direct trigger is root running su to such an account, a non-root user holding a narrow sudo delegation to run a command as that account can reach the same code path. The resulting impact is denial of service through broken ownership checks affecting SSH, sudo, and package management, not privilege escalation: Red Hat Enterprise Linux ships / with restrictive 0555 permissions, so the new unprivileged owner is not granted write access to the filesystem root. Red Hat Enterprise Linux 9.9 and 10.3 are not affected, as an unrelated upstream refactor changed the home-directory-creation logic so ownership is only changed when a new directory is actually created rather than when the target already exists. This issue was discovered by Runar Lundgren (Red Hat). Do not enable mkhomedir in pam_winbind.conf on systems where any account (including system accounts) may resolve to a home directory of / or another sensitive system path. Red Hat Enterprise Linux 10 Affected samba-winbind Red Hat Enterprise Linux 6 Out of support scope samba-winbind Red Hat Enterprise Linux 7 Will not fix samba-winbind Red Hat Enterprise Linux 8 Affected samba-winbind Red Hat Enterprise Linux 9 Affected samba-winbind https://www.cve.org/CVERecord?id=CVE-2026-15779 https://nvd.nist.gov/vuln/detail/CVE-2026-15779 https://gitlab.com/samba-team/samba/-/blob/samba-4.19.4/nsswitch/pam_winbind.c https://gitlab.com/samba-team/samba/-/blob/samba-4.23.5/nsswitch/pam_winbind.c#L1622 https://gitlab.com/samba-team/samba/-/blob/samba-4.24.3/nsswitch/pam_winbind.c#L1590