A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.

Red Hat Product Security has rated this vulnerability as having a Moderate security impact for Samba deployments operating as an Active Directory Domain Controller (AD DC) using the internal DNS server. ``` Red Hat Enterprise Linux (RHEL) context: Standard Red Hat Enterprise Linux deployments are not affected. RHEL provides Samba for use as a file server, print server, or Active Directory domain member (via Winbind), but does not support the Samba Active Directory Domain Controller (AD DC) role or its internal DNS server, where this vulnerability resides. ``` ``` Additionally, Samba AD DC deployments configured to use the external BIND9 DLZ backend instead of the internal DNS server are not affected by this vulnerability. ``` Red Hat would like to thank Andrew Tridgell (Samba Team) and Tristan Madani (Talence Security) for reporting this issue. Red Hat Enterprise Linux 10 Not affected samba Red Hat Enterprise Linux 6 Not affected samba Red Hat Enterprise Linux 6 Not affected samba4 Red Hat Enterprise Linux 7 Not affected samba Red Hat Enterprise Linux 8 Not affected samba Red Hat Enterprise Linux 9 Not affected samba Red Hat OpenShift Container Platform 4 Not affected rhcos https://www.cve.org/CVERecord?id=CVE-2026-58218 https://nvd.nist.gov/vuln/detail/CVE-2026-58218 https://bugzilla.samba.org/show_bug.cgi?id=16115 https://www.samba.org/samba/security/CVE-2026-58218.html