CVE-2026-3238: Samba WINS Server DOS Vulnerability

CVE-2026-3238 Overview

CVE-2026-3238 is a NULL pointer dereference vulnerability [CWE-476] in the Windows Internet Name Service (WINS) server component of Samba when running as an Active Directory Domain Controller. The WINS protocol handlers fail to properly validate incoming packets for certain request types. An unauthenticated remote attacker can send specially crafted User Datagram Protocol (UDP) packets to crash the WINS service. The flaw affects availability only and does not expose data confidentiality or integrity.

Critical Impact
Unauthenticated remote attackers can crash the Samba WINS service over the network using crafted UDP packets, disrupting NetBIOS name resolution for dependent clients.

Affected Products

Samba running as an Active Directory Domain Controller with the WINS server component enabled
Red Hat distributions packaging affected Samba versions (see Red Hat advisory)
Any downstream Linux distribution shipping the impacted Samba release

Discovery Timeline

2026-06-08 - CVE-2026-3238 published to the National Vulnerability Database (NVD)
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-3238

Vulnerability Analysis

The vulnerability resides in Samba's WINS server protocol handlers. WINS is a NetBIOS name resolution service that listens on UDP port 137. When Samba operates as an Active Directory Domain Controller with WINS enabled, it accepts and processes incoming UDP datagrams from network clients.

For specific WINS request types, the handlers do not validate fields within the inbound packet before dereferencing internal pointers. Supplying a malformed datagram causes the service to access a NULL pointer and abort. The result is a service crash that interrupts name resolution for dependent clients.

Because WINS uses connectionless UDP transport, exploitation does not require a session, authentication, or user interaction. A single crafted packet is sufficient to trigger the fault.

Root Cause

The root cause is missing input validation on selected WINS request types. The handler dereferences a pointer that can be NULL when the attacker omits or malforms an expected packet field. The defect is classified under [CWE-476] NULL Pointer Dereference.

Attack Vector

The attack vector is network-based with low complexity. An attacker sends a single crafted UDP packet to the WINS service. No credentials, prior access, or victim interaction are required. The impact is limited to denial of service against the WINS process and any clients relying on it for name resolution.

No public proof-of-concept code or exploitation in the wild has been reported. Refer to the Samba CVE-2026-3238 Security Notice for vendor technical details.

Detection Methods for CVE-2026-3238

Indicators of Compromise

Unexpected termination, segmentation faults, or restarts of the samba or nmbd process logged in system journals
Bursts of malformed inbound UDP traffic to port 137 from a single or small set of source addresses
Client-side NetBIOS name resolution failures coinciding with service crashes on the Domain Controller

Detection Strategies

Monitor host logs and systemd journal entries for repeated WINS or nmbd service restarts and core dumps
Deploy network intrusion detection signatures that flag malformed WINS request packets to UDP 137
Correlate process crash events with concurrent inbound UDP 137 traffic to identify exploitation attempts

Monitoring Recommendations

Alert on Samba service restarts exceeding a baseline threshold within a short interval
Capture and retain packet metadata for UDP 137 on Domain Controllers to enable forensic review
Track availability metrics for NetBIOS name resolution and trigger alerts on sudden client failures

How to Mitigate CVE-2026-3238

Immediate Actions Required

Apply vendor-supplied Samba security updates as soon as packages are available from your Linux distribution
Inventory Domain Controllers running Samba and confirm whether the WINS server component is enabled
Restrict UDP port 137 access at perimeter and internal firewalls to trusted management networks only

Patch Information

Consult the Samba CVE-2026-3238 Security Notice and the Red Hat CVE-2026-3238 Advisory for fixed package versions and update instructions. Additional analysis is available in Red Hat Bugzilla Report #2486176.

Workarounds

Disable the WINS server component in smb.conf by setting wins support = no if the service is not required
Block or rate-limit inbound UDP traffic to port 137 on the Domain Controller from untrusted networks
Migrate name resolution to Domain Name System (DNS) where feasible to reduce reliance on WINS

bash

# Configuration example: disable WINS support in smb.conf
[global]
    wins support = no

# Restrict UDP 137 to trusted subnets using iptables
iptables -A INPUT -p udp --dport 137 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 137 -j DROP