CVE-2026-15779
Description
A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.
Statement
Red Hat Product Security rates this flaw's impact as Moderate. Exploitation requires mkhomedir to be explicitly enabled in pam_winbind.conf, a non-default option used specifically in Active Directory domain-integration deployments, and a PAM session to be opened for an account whose home directory resolves to /. While the most direct trigger is root running su to such an account, a non-root user holding a narrow sudo delegation to run a command as that account can reach the same code path. The resulting impact is denial of service through broken ownership checks affecting SSH, sudo, and package management, not privilege escalation: Red Hat Enterprise Linux ships / with restrictive 0555 permissions, so the new unprivileged owner is not granted write access to the filesystem root. Red Hat Enterprise Linux 9.9 and 10.3 are not affected, as an unrelated upstream refactor changed the home-directory-creation logic so ownership is only changed when a new directory is actually created rather than when the target already exists.
Mitigation
Do not enable mkhomedir in pam_winbind.conf on systems where any account (including system accounts) may resolve to a home directory of / or another sensitive system path.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | N/A | 6.1 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
An attacker may be able to read sensitive information from the associated resource, such as credentials or configuration information stored in a file.
Access Control
Technical Impact: Gain Privileges or Assume Identity
An attacker may be able to modify critical properties of the associated resource to gain privileges, such as replacing a world-writable executable with a Trojan horse.
Integrity,Other
Technical Impact: Modify Application Data; Other
An attacker may be able to destroy or corrupt critical data in the associated resource, such as deletion of records from a database.
Acknowledgements
This issue was discovered by Runar Lundgren (Red Hat).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
