This Red Hat security advisory addresses multiple vulnerabilities in Samba, including two critical remote code execution flaws in the printing subsystem (CVE-2026-4480) and the SAMR protocol (CVE-2026-4408), alongside other high-severity issues like improper certificate validation (CVE-2026-3012, CVSS 8.0). Based on the authoritative NVD data, affected versions include Samba 4.16.0 through 4.20.x for CVE-2026-3012, requiring an upgrade to version 4.21.0, and Samba 4.1.0 through 4.2.1 for CVE-2026-1933, requiring an upgrade to version 4.2.2.
Red Hat Product Errata RHSA-2026:25979 - Security Advisory Issued: 2026-06-15 Updated: 2026-06-15 RHSA-2026:25979 - Security Advisory Overview Updated Packages Synopsis Important: samba security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for samba is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): samba: Missing access check on reparse point operations (CVE-2026-1933) samba: vfs_worm does not block directory modification (CVE-2026-2340) samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012) samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480) samba: Remote Code Execution in SAMR (CVE-2026-4408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 Red Hat Enterprise Linux Server - AUS 9.6 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 9.6 x86_64 Red Hat Enterprise Linux Resilient Storage for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 Red Hat Enterprise Linux Resilient Storage for IBM z Systems - Extended Update Support 9.6 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x Red Hat Enterprise Linux Resilient Storage for x86_64 - 4 years of updates 9.6 x86_64 Red Hat Enterprise Linux Resilient Storage for Power, little endian - 4 years of updates 9.6 ppc64le Red Hat Enterprise Linux Resilient Storage for IBM z Systems - 4 years of updates 9.6 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x Red Hat Enterprise Linux Resilient Storage for Power, little endian - Extended Life Cycle 9.6 ppc64le Red Hat Enterprise Linux Resilient Storage for IBM z Systems - Extended Life Cycle 9.6 s390x Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Life Cycle 9.6 x86_64 Fixes BZ - 2447317 - CVE-2026-1933 samba: Missing access check on reparse point operations BZ - 2447318 - CVE-2026-2340 samba: vfs_worm does not block directory modification BZ - 2447319 - CVE-2026-3012 samba: group policy certificate enrollment uses http:// without validation BZ - 2452232 - CVE-2026-4480 samba: Samba: Remote Code Execution in printing subsystem via unescaped job description BZ - 2479762 - CVE-2026-4408 samba: Remote Code Execution in SAMR CVEs CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4408 CVE-2026-4480 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 SRPM samba-4.21.3-14.el9_6.1.src.rpm SHA-256: 42bc3567e9066a7557fd4610a8cac8bd98e5f3c4c464ec29b174132236c2319f x86_64 ctdb-debuginfo-4.21.3-14.el9_6.1.i686.rpm SHA-256: dd98e8b084b2c2e5a9948ce297a70c124e69dceaddae3c765a67e191b22fa966 ctdb-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 373e72955cc9cb226766ab68dd57e9499764310f6662c26d6939109d6463b057 ctdb-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 373e72955cc9cb226766ab68dd57e9499764310f6662c26d6939109d6463b057 ldb-tools-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 3b71bda8adc8812d57e9d7a9413913739d742ff6aaa466adb63df3370565f5e9 ldb-tools-debuginfo-4.21.3-14.el9_6.1.i686.rpm SHA-256: 4fbebd0c09fa9363adc67f97d5829590053bcfc51ddede93dbd53dc8f64814d0 ldb-tools-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 6e8742e16b9c38a5e25a74d75832c9dbc92d4fcab0e51b442f0500683d442ade ldb-tools-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 6e8742e16b9c38a5e25a74d75832c9dbc92d4fcab0e51b442f0500683d442ade libldb-4.21.3-14.el9_6.1.i686.rpm SHA-256: f11dc0fa9da89fb956f8833b1be0d2aa258237d156d6438fe7927a058b0413a2 libldb-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 0b51cb025852f4f7cd8bf6d8b0f570e74b1f5758a920d9091e40d6deabd1cd25 libldb-debuginfo-4.21.3-14.el9_6.1.i686.rpm SHA-256: ecd8db0883eafafebd78463e2abb919ef10676d642e099b01f322c77924869e0 libldb-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: f920c5885c1857c1b4717bd5fa13d8dfae1e1e44e8e7de2509ccaea9443a863d libldb-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: f920c5885c1857c1b4717bd5fa13d8dfae1e1e44e8e7de2509ccaea9443a863d libnetapi-4.21.3-14.el9_6.1.i686.rpm SHA-256: 110d3d853f8f3bb1cdefb14bb8b8114a612d6ecc002906623f123ad4fffd7cb9 libnetapi-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 26fb87e5d1d0b281da030747e5f76b1c875197ca805f3f58d83b3023055cc740 libnetapi-debuginfo-4.21.3-14.el9_6.1.i686.rpm SHA-256: eb311f6cf8238f08233938d1e15c6bde33bfea36236119d7109af1048b8dace6 libnetapi-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 64bd390e99a618bfafc3da0a6f106404bd9f3f1355904421f72cb34e269bb27a libnetapi-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 64bd390e99a618bfafc3da0a6f106404bd9f3f1355904421f72cb34e269bb27a libsmbclient-4.21.3-14.el9_6.1.i686.rpm SHA-256: 5d95fc2536e0303b7fd7839a09a293c4f6a0599c3bd3d55c18ec61599e985d8d libsmbclient-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 5f8202810bc1fe49ba92b7549ccdb825c7794b4ffa774294d96058efa92b4960 libsmbclient-debuginfo-4.21.3-14.el9_6.1.i686.rpm SHA-256: e83a2a544f71f50b4a8ed2097ba8dfd11e2c5c9f085ceb19bbec91342b905806 libsmbclient-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: c8d8ec0a1aa87e02ce70ab1431765b95ccd4815901a11416869682b2dad6a34b libsmbclient-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: c8d8ec0a1aa87e02ce70ab1431765b95ccd4815901a11416869682b2dad6a34b libwbclient-4.21.3-14.el9_6.1.i686.rpm SHA-256: 253b62004d75188e8f910019d06de149d1c4ad6bfd25afe7033f93c380b53605 libwbclient-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 7222a45bd3538f185fbd8ca29edb8526b6ac0e0fb7b08fe1e93dd8fc138ad2d6 libwbclient-debuginfo-4.21.3-14.el9_6.1.i686.rpm SHA-256: 8d1d4e4e60075f0aaf2c28a6bcc099051a177774cf3026fb65896db62b9d04c5 libwbclient-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 6636ea8434900ae19b2e8ac17c15987e0c32fb108401d5004303019bc49c7754 libwbclient-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 6636ea8434900ae19b2e8ac17c15987e0c32fb108401d5004303019bc49c7754 python3-ldb-4.21.3-14.el9_6.1.i686.rpm SHA-256: b60f6d576fb3d0a69d3e70dc642d4a7e0fb574c2f0b56c959d2ce4e5aeecebc4 python3-ldb-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 2963e76c1b1a6863f56e03b40dfcaa22bb19c6e5dedaabc0881bf55b653cf334 python3-ldb-debuginfo-4.21.3-14.el9_6.1.i686.rpm SHA-256: 5e30fb6bbdf9ba621039eba9d7bc7d717b1f0b4ce1da279286e1f60b0a89e770 python3-ldb-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 794b464c30628d8b528961a38fd4bc136b858775869e06dc063aa25e4ff26ab9 python3-ldb-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 794b464c30628d8b528961a38fd4bc136b858775869e06dc063aa25e4ff26ab9 python3-samba-4.21.3-14.el9_6.1.i686.rpm SHA-256: b1f888dcb73d98cd0279c8f7eb15d49319d35986dd936ad9c05bb3468066678d python3-samba-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 636e7b9ba127948ad27e67daad0c178ee2358e4ba38454f0e299ca1fbb409cff python3-samba-dc-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 1653794324be7b6ad291a3629688017ffc5c32f0680963f923ce77f4e071550f python3-samba-dc-debuginfo-4.21.3-14.el9_6.1.i686.rpm SHA-256: 056e19aa4e5419625f82838582a7d0e040a680fbfad7a10d80455980364e2faa python3-samba-dc-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: b8010c028d8e6fe3907faa7f0a2e43609681ffc74e231b47b86179e67d9895ff python3-samba-dc-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: b8010c028d8e6fe3907faa7f0a2e43609681ffc74e231b47b86179e67d9895ff python3-samba-debuginfo-4.21.3-14.el9_6.1.i686.rpm SHA-256: f5b8d5b002aecc494aa560596277a37b273cd8eba8095c31e2ecf04353ac559a python3-samba-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 0704f56e2870d1c1573c0673e9a2106c2c13765fa3ef229dbfa5ffa39e18787b python3-samba-debuginfo-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 0704f56e2870d1c1573c0673e9a2106c2c13765fa3ef229dbfa5ffa39e18787b samba-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 7b6027cfc1d3d278c03eab2eada71fd63b9c6acd270c1389841b0b11b966c312 samba-client-4.21.3-14.el9_6.1.x86_64.rpm SHA-256: 0a807c969f2c97b942465ccaab10a9d67cf64597be4af605876d182c40f91902 samba-client-debuginfo-4.21.