---
id: CVE-2026-15779
title: >-
  Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths
  without validation
summary: >-
  A flaw was found in samba's pam_winbind. When mkhomedir is enabled,
  pam_winbind chowns the target account's home directory without validating the
  path is not a critical system directory such as /. On affected systems,
  accounts with / as …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-732
vendor: Red Hat
product: samba-winbind
affected:
  - samba-winbind (all versions)
  - samba-winbind
  - samba-winbind (all versions)
  - samba-winbind (all versions)
  - samba-winbind (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-15T13:04:26.614098Z'
published: '2026-07-15'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:42:54.277Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-15779'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-15779'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2499991'
    label: RHBZ#2499991
  - url: >-
      https://gitlab.com/samba-team/samba/-/blob/samba-4.19.4/nsswitch/pam_winbind.c
  - url: >-
      https://gitlab.com/samba-team/samba/-/blob/samba-4.23.5/nsswitch/pam_winbind.c#L1622
  - url: >-
      https://gitlab.com/samba-team/samba/-/blob/samba-4.24.3/nsswitch/pam_winbind.c#L1590
tags:
  - cve.org
epss: 0.00105
epssPercentile: 0.01059
ingestedAt: '2026-11-05T22:38:31.394Z'
---

## Overview

A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.

## Affected

- `samba-winbind (all versions)`
- `samba-winbind`
- `samba-winbind (all versions)`
- `samba-winbind (all versions)`
- `samba-winbind (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Do not enable mkhomedir in pam_winbind.conf on systems where any account (including system accounts) may resolve to a home directory of / or another sensitive system path.