ALAS2023-2026-2135

References: CVE-2026-15779  CVE-2026-58218  CVE-2026-6949 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation. (CVE-2026-15779)

DNS signing DoS via TKEY name cache exhaustion

NOTE: https://www.samba.org/samba/security/CVE-2026-58218-advisory.html (CVE-2026-58218)

TSIG packet with name compression can crash DNS (CVE-2026-6949)

Issue Correction:
Run dnf update samba --releasever 2023.12.20260914 or dnf update --advisory ALAS2023-2026-2135 --releasever 2023.12.20260914 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    samba-test-4.17.12-1.amzn2023.0.7.aarch64
    libnetapi-devel-4.17.12-1.amzn2023.0.7.aarch64
    libnetapi-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    python3-samba-devel-4.17.12-1.amzn2023.0.7.aarch64
    samba-common-tools-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-winbind-modules-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-libs-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-usershares-4.17.12-1.amzn2023.0.7.aarch64
    samba-tools-4.17.12-1.amzn2023.0.7.aarch64
    libsmbclient-devel-4.17.12-1.amzn2023.0.7.aarch64
    libsmbclient-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-vfs-iouring-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-test-libs-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-winbind-modules-4.17.12-1.amzn2023.0.7.aarch64
    samba-krb5-printing-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-4.17.12-1.amzn2023.0.7.aarch64
    samba-common-tools-4.17.12-1.amzn2023.0.7.aarch64
    samba-debugsource-4.17.12-1.amzn2023.0.7.aarch64
    samba-krb5-printing-4.17.12-1.amzn2023.0.7.aarch64
    libwbclient-4.17.12-1.amzn2023.0.7.aarch64
    python3-samba-test-4.17.12-1.amzn2023.0.7.aarch64
    samba-client-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-client-4.17.12-1.amzn2023.0.7.aarch64
    samba-winbind-krb5-locator-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    libnetapi-4.17.12-1.amzn2023.0.7.aarch64
    samba-ldb-ldap-modules-4.17.12-1.amzn2023.0.7.aarch64
    samba-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-devel-4.17.12-1.amzn2023.0.7.aarch64
    python3-samba-dc-4.17.12-1.amzn2023.0.7.aarch64
    python3-samba-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-dc-libs-4.17.12-1.amzn2023.0.7.aarch64
    samba-libs-4.17.12-1.amzn2023.0.7.aarch64
    samba-winbind-4.17.12-1.amzn2023.0.7.aarch64
    samba-test-libs-4.17.12-1.amzn2023.0.7.aarch64
    samba-winbind-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-dc-libs-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-dcerpc-4.17.12-1.amzn2023.0.7.aarch64
    libwbclient-devel-4.17.12-1.amzn2023.0.7.aarch64
    samba-client-libs-4.17.12-1.amzn2023.0.7.aarch64
    libsmbclient-4.17.12-1.amzn2023.0.7.aarch64
    samba-client-libs-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-test-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-winbind-clients-4.17.12-1.amzn2023.0.7.aarch64
    libwbclient-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-winbind-krb5-locator-4.17.12-1.amzn2023.0.7.aarch64
    samba-winbind-clients-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-vfs-iouring-4.17.12-1.amzn2023.0.7.aarch64
    python3-samba-dc-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-common-libs-4.17.12-1.amzn2023.0.7.aarch64
    python3-samba-4.17.12-1.amzn2023.0.7.aarch64
    samba-common-libs-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-dcerpc-debuginfo-4.17.12-1.amzn2023.0.7.aarch64
    samba-ldb-ldap-modules-debuginfo-4.17.12-1.amzn2023.0.7.aarch64

noarch:
    samba-pidl-4.17.12-1.amzn2023.0.7.noarch
    samba-common-4.17.12-1.amzn2023.0.7.noarch

src:
    samba-4.17.12-1.amzn2023.0.7.src

x86_64:
    samba-common-libs-4.17.12-1.amzn2023.0.7.x86_64
    python3-samba-test-4.17.12-1.amzn2023.0.7.x86_64
    samba-debugsource-4.17.12-1.amzn2023.0.7.x86_64
    samba-common-tools-4.17.12-1.amzn2023.0.7.x86_64
    samba-ldb-ldap-modules-4.17.12-1.amzn2023.0.7.x86_64
    samba-client-4.17.12-1.amzn2023.0.7.x86_64
    samba-usershares-4.17.12-1.amzn2023.0.7.x86_64
    samba-libs-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-krb5-printing-4.17.12-1.amzn2023.0.7.x86_64
    samba-dc-libs-4.17.12-1.amzn2023.0.7.x86_64
    libwbclient-4.17.12-1.amzn2023.0.7.x86_64
    samba-dcerpc-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-4.17.12-1.amzn2023.0.7.x86_64
    samba-test-libs-4.17.12-1.amzn2023.0.7.x86_64
    python3-samba-dc-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-tools-4.17.12-1.amzn2023.0.7.x86_64
    samba-winbind-clients-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-krb5-printing-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    libwbclient-devel-4.17.12-1.amzn2023.0.7.x86_64
    libnetapi-4.17.12-1.amzn2023.0.7.x86_64
    samba-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-ldb-ldap-modules-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-dc-libs-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    python3-samba-devel-4.17.12-1.amzn2023.0.7.x86_64
    samba-common-tools-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    libnetapi-devel-4.17.12-1.amzn2023.0.7.x86_64
    libnetapi-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-client-libs-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-winbind-4.17.12-1.amzn2023.0.7.x86_64
    libwbclient-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    libsmbclient-4.17.12-1.amzn2023.0.7.x86_64
    python3-samba-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-vfs-iouring-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-winbind-modules-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-winbind-modules-4.17.12-1.amzn2023.0.7.x86_64
    libsmbclient-devel-4.17.12-1.amzn2023.0.7.x86_64
    samba-winbind-krb5-locator-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-vfs-iouring-4.17.12-1.amzn2023.0.7.x86_64
    samba-dcerpc-4.17.12-1.amzn2023.0.7.x86_64
    samba-test-4.17.12-1.amzn2023.0.7.x86_64
    samba-winbind-clients-4.17.12-1.amzn2023.0.7.x86_64
    samba-winbind-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-client-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    libsmbclient-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-test-libs-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-test-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    python3-samba-dc-4.17.12-1.amzn2023.0.7.x86_64
    samba-common-libs-debuginfo-4.17.12-1.amzn2023.0.7.x86_64
    samba-winbind-krb5-locator-4.17.12-1.amzn2023.0.7.x86_64
    samba-devel-4.17.12-1.amzn2023.0.7.x86_64
    python3-samba-4.17.12-1.amzn2023.0.7.x86_64
    samba-libs-4.17.12-1.amzn2023.0.7.x86_64
    samba-client-libs-4.17.12-1.amzn2023.0.7.x86_64