CVE-2026-15779

Medium · 6.1

CVSS

6.1

EPSS

0.1%

Published

Jul 15, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Samba login feature meant to create user folders can accidentally take ownership of the entire computer's main folder when triggered by certain limited administrative rights, breaking logins and updates across the system.

Exploitation: Local Privilege
Attacker needs: Low Privilege
Complexity: Low
Impact: Denial Of Service
Component: Application
Class: Improper Input Validation
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

pam_winbind performs chown on the home directory supplied by the account without validating that the path is not a critical system directory such as / when the mkhomedir module is enabled.

Why it matters to the business

Systems relying on Samba for PAM authentication with automatic home directory creation can suffer widespread loss of SSH, sudo, and package management functionality after a single mis-triggered chown of the root filesystem, increasing operational downtime and recovery effort even though no data is altered.

How an attack unfolds

An attacker who already possesses a narrow sudo delegation allowing execution of commands as a system account whose home directory is set to / triggers pam_winbind (with mkhomedir enabled) during authentication or session setup; the missing path validation causes the process to change ownership of /, resulting in immediate denial of service for login and administrative tools.

How to fix it

Disable the mkhomedir option in pam_winbind configuration or ensure PAM home-directory creation is performed only after explicit path validation; apply any upstream Samba updates that add the missing directory checks when they become available.

How to confirm the fix worked

Inspect /etc/pam.d and /etc/security/pam_winbind.conf for mkhomedir usage, verify that no system accounts have / as their home directory in /etc/passwd, and test account creation flows in a lab environment to confirm ownership changes are rejected for unsafe paths.

Typical attack path

Obtain limited sudo rights to run commands as a target system account whose home directory is /
Execute a command that causes pam_winbind to process the account with mkhomedir enabled
pam_winbind performs chown on the supplied home directory without path validation
Ownership of / changes, breaking SSH, sudo, and package managers

How to detect it

Search authentication and sudo logs for pam_winbind sessions involving accounts whose home directory is /, and examine auditd or filesystem change logs for chown syscalls targeting the root directory from pam or winbind processes.

pam_winbind.*mkhomedir
chown.*home=/
chown.* /
winbindd.*chown

What your security team should do

Audit all sudoers entries that allow execution as system accounts
Review and disable mkhomedir in pam_winbind where feasible
Add filesystem monitoring for unexpected chown operations on /
Plan for prompt patching once fixed Samba packages are released

The record

A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.

Affected packages

Ecosystem	Package	Introduced	Fixed