CVE-2026-15779: Samba pam_winbind DOS Vulnerability

CVE-2026-15779 Overview

CVE-2026-15779 is a permission assignment flaw [CWE-732] in Samba's pam_winbind module. When mkhomedir is enabled, pam_winbind changes ownership of the target account's home directory without validating that the path is not a critical system directory such as /. Accounts configured with / as their home directory, a common default for system accounts, can trigger a chown of the root filesystem. The change causes availability loss including SSH, sudo, and package-manager failures on the affected host.

Critical Impact
A local user with narrow sudo delegation to run commands as a system account whose home directory is / can cause ownership of the root filesystem to change, producing a severe denial of service across SSH, sudo, and package management.

Affected Products

Samba pam_winbind module in the nsswitch component
Samba release branches including 4.19.4, 4.23.5, and 4.24.3 source trees
Linux distributions shipping Samba with pam_winbind and mkhomedir enabled, including Red Hat Enterprise Linux

Discovery Timeline

2026-07-15 - CVE CVE-2026-15779 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15779

Vulnerability Analysis

The flaw resides in Samba's pam_winbind.c, specifically in the logic that provisions a user's home directory when the mkhomedir option is enabled. During login, pam_winbind calls chown on the resolved home directory path to assign ownership to the authenticating user. The code path does not verify that the resolved directory is a legitimate per-user home rather than a shared or system directory such as /, /etc, or /var.

Because many system accounts ship with / set as the home directory field in /etc/passwd, a login through pam_winbind for such an account will chown the entire root filesystem. On Red Hat Enterprise Linux, / ships with 0555 permissions, so the ownership change does not grant write access. The impact is availability loss rather than privilege escalation, because SSH, sudo, and package-manager binaries perform strict ownership checks on filesystem parents and refuse to operate when / is no longer owned by root.

Root Cause

The root cause is missing path validation before a privileged file-system operation, mapped to CWE-732 (Incorrect Permission Assignment for Critical Resource). pam_winbind trusts the home directory value returned from the user database and applies chown without an allowlist, deny-list, or sanity check against critical system paths.

Attack Vector

Exploitation is local. The attacker needs the ability to invoke pam_winbind with the identity of an account whose home directory is /. This can be root or, more importantly, any unprivileged user holding a narrow sudo delegation such as sudo -u <system-account> to run a command that triggers a PAM session with mkhomedir enabled. When the PAM session initializes, the home directory creation path in pam_winbind.c executes and calls chown on /, altering ownership of the root filesystem.

No exploitation code is required. See the Samba source reference for 4.24.3 and the Red Hat CVE Report for the affected code paths.

Detection Methods for CVE-2026-15779

Indicators of Compromise

Ownership of / changed from root:root to a system or domain account UID/GID, visible via stat / or ls -ld /.
SSH daemon refusing logins with Authentication refused: bad ownership or modes for directory / messages in /var/log/secure or journalctl -u sshd.
sudo failing with errors referencing directory ownership or effective UID checks on root-owned paths.
Package manager operations (dnf, yum, rpm) failing during transaction verification because / is no longer owned by root.

Detection Strategies

Enumerate accounts in /etc/passwd and directory services where the home field is set to / or another critical path, and cross-reference against accounts reachable via pam_winbind.
Audit pam_winbind and pam_mkhomedir configuration under /etc/pam.d/ for the presence of mkhomedir on services that accept winbind authentication.
Monitor for chown syscalls targeting / or top-level system directories using auditd rules on the chown, fchown, and fchownat syscalls.
Review sudoers policies for delegations that allow non-root users to run commands as system accounts whose home directory is /.

Monitoring Recommendations

Alert on any change to the ownership of /, /etc, /var, /usr, or /boot using file-integrity monitoring.
Correlate PAM session-open events for pam_winbind with subsequent chown activity on paths outside /home.
Track sudo invocations that specify -u targeting local system accounts and flag those that trigger a PAM session with mkhomedir enabled.

How to Mitigate CVE-2026-15779

Immediate Actions Required

Inventory all accounts, local and directory-served, whose home directory is set to / or another system path, and change these to /var/empty, /sbin/nologin-style stubs, or dedicated per-account directories.
Remove or restrict sudo delegations that permit non-root users to execute commands as system accounts with / as their home directory.
Disable mkhomedir in /etc/pam.d/ service stacks that use pam_winbind until a patched Samba package is installed.
Verify current ownership of / with stat -c '%U:%G' / and restore to root:root with chown root:root / if drift is observed.

Patch Information

Refer to the Red Hat CVE Report for CVE-2026-15779 and the Red Hat Bug Report for fixed package versions and vendor guidance. Upstream fixes are tracked in the Samba repository under nsswitch/pam_winbind.c; see the Samba 4.24.3 source reference and the Samba 4.23.5 source reference. Apply distribution updates for samba-winbind and restart services that load pam_winbind.

Workarounds

Reassign any account with HOMEDIR=/ to a safe path using usermod -d /var/lib/<account> <account> before enabling pam_winbind sessions.
Remove mkhomedir from PAM service stacks that authenticate against winbind by editing /etc/pam.d/system-auth and /etc/pam.d/password-auth.
Constrain sudoers rules so that non-root users cannot invoke PAM-initiating commands as system accounts.

bash

# Configuration example
# Verify root filesystem ownership
stat -c '%U:%G %n' /

# Identify accounts with '/' as their home directory
awk -F: '$6=="/" {print $1}' /etc/passwd

# Reassign a system account away from '/'
usermod -d /var/lib/example-account example-account

# Disable mkhomedir in PAM stacks using pam_winbind
sed -i '/pam_mkhomedir.so/ s/^/#/' /etc/pam.d/system-auth /etc/pam.d/password-auth

# Restore ownership if '/' has been altered
chown root:root /
chmod 0555 /