Samba 4.23.12 Drops as a Quiet Maintenance Release for Active Installations
The twelfth point release for the older stable branch has been released. It is a strictly maintenance-focused build. If you run Samba as a file server, domain controller, or print host, this one hits right on schedule.
The 4.23 line has had a rough eighteen months. Since the branch launched in September 2025, it has weathered a heavy string of security patches. May brought a CVSS 10.0 remote code execution flaw in the print subsystem, and July forced six coordinated advisories across three active branches. This release follows that wave. It's not patching holes. It's cleaning up the cracks they left behind.
The original creator, Andrew Tridgell, actually named the project by running a grep command through a Unix dictionary looking for words that contained S, M, and B in that order. It was previously called netbios for unix, but a trademark conflict with Syntax Inc. forced the rename. That bit of open-source history is why your file server bears the name of a dance. It is easy to forget how much of modern enterprise networking still rides on that foundation.
What’s Actually New
The changelog is heavy on plumbing. DNS gets the most attention here. Samba’s internal DNS server now switches cleanly from UDP to TCP when responses exceed 4K bytes. It also stops scavenging records when the fAging flag is off, and finally gets its EDNS client behavior straight. If you've been chasing random DNS timeouts or aging bugs, you will finally have somewhere to point your support tickets.
Threading sees two fixes from Noel Power at SUSE. The pthreadpool double-free crash and the race condition between the jobs list and glue list are gone. Build infrastructure gets a trim too. Andreas Schneider and Anoop C S untangled a cmocka macro conflict that broke test compilation on newer CI systems, and Stefan Metzmacher stopped ndr_{push,pull,print} from encoding time values twice.
File server and HA folks are not forgotten. Andreas Schneider fixed incorrect stream create-disposition behavior after a prior handle closes, and Martin Schwenke at DDN resolved an inactive CTDB node running recovery and corrupting databases. A couple of flaky torture tests finally got marked as flappy so CI stops flagging them.
The Security Backdrop
You won't find any new CVEs in 4.23.12. The real story is what happened in the previous two releases. The May 2026 patch for CVE-2026-4480 addressed an unauthenticated shell injection in Samba's print command when %J was used. Guest accounts could trigger full remote code execution by default. It remains one of the most dangerous print-related flaws in open-source file server history.
July's wave was equally steep. Two high-severity flaws reported by OpenAI Security Research rewrote the rules for LDAP access. CVE-2026-58221 let a low-privilege domain user hijack the DSDB module chain through LDAP, granting unrestricted directory access. CVE-2026-58222 combined filter injection with a trusted-search-context flaw to extract KDS root keys, which then broke gMSA passwords offline. Talence Security, Securin Labs, and SafeBreach rounded out the advisory list.
It is a reminder that Samba still sits at the center of Windows networking. Even with SMB2 and SMB3 dominant, the underlying protocol surface is wide, and attackers keep finding new ways to squeeze through it.
This release is exactly what you want from a point update. Quiet. Targeted. Low-risk. Not cheap in terms of maintenance overhead, but exactly the kind of polish that keeps long-running branches stable. The release notes note that 4.23.12 follows "the major security release of 4.23.10 and the interim 4.23.11." If you have not already, the July security patch is non-negotiable. 4.23.12 just makes the ride smoother.
The source tarball and incremental patch are live at download.samba.org. Head here for the full release notes.
