{"id":"CVE-2026-15779","title":"Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation","summary":"A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as …","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cvssSource":"cna","cwe":["CWE-732"],"vendor":"Red Hat","product":"samba-winbind","affected":["samba-winbind (all versions)","samba-winbind","samba-winbind (all versions)","samba-winbind (all versions)","samba-winbind (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-15T13:04:26.614098Z"},"published":"2026-07-15","updated":"2026-11-05","sourceUpdated":"2026-11-05T16:42:54.277Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-15779","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-15779"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499991","label":"RHBZ#2499991"},{"url":"https://gitlab.com/samba-team/samba/-/blob/samba-4.19.4/nsswitch/pam_winbind.c"},{"url":"https://gitlab.com/samba-team/samba/-/blob/samba-4.23.5/nsswitch/pam_winbind.c#L1622"},{"url":"https://gitlab.com/samba-team/samba/-/blob/samba-4.24.3/nsswitch/pam_winbind.c#L1590"}],"tags":["cve.org"],"epss":0.00105,"epssPercentile":0.01059,"ingestedAt":"2026-11-05T22:38:31.394Z","slug":"CVE-2026-15779","body":"## Overview\n\nA flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.\n\n## Affected\n\n- `samba-winbind (all versions)`\n- `samba-winbind`\n- `samba-winbind (all versions)`\n- `samba-winbind (all versions)`\n- `samba-winbind (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nDo not enable mkhomedir in pam_winbind.conf on systems where any account (including system accounts) may resolve to a home directory of / or another sensitive system path.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}