Samba 4.24.7 is now available as a stability-focused point release addressing ten tracked bugs discovered since the previous update. The release primarily targets the internal DNS stack with fixes for UDP-to-TCP fallback failures, unwanted record scavenging on disabled zones, and EDNS negotiation issues. Additional patches resolve silent POSIX ACL errors on Windows shares, inactive cluster node recovery conflicts, and stream handle state corruption. While this release contains no new CVEs, it arrives shortly after Samba published 4.25.0rc2 for previewing the next development branch.

Samba 4.24.7 Released: DNS and Stability Fixes Land

The September 9 update addresses ten tracked issues across Samba's internal DNS server, POSIX ACL handling, and Active Directory cluster logic.

Samba has dropped Samba 4.24.7, a point release aimed at ironing out wrinkles in the internal DNS server, POSIX ACL handling, and Active Directory cluster stability. The update hit the servers today. While it doesn't patch any new CVEs, it addresses ten tracked bugs discovered since 4.24.6 shipped about four weeks ago.

This release arrives in the long shadow of July's security bombshell. On July 28, Samba published fixes for six CVEs across three release branches, including a critical CVSS 10.0 remote code execution in the SAMR DCE/RPC layer via %u substitution. That advisory was one of the most impactful in recent Samba history, with the RCE originally reported by SafeBreach and ZeroPath researchers. 4.24.7 doesn't add to that count, but several of its fixes target the internal DNS stack, the same subsystem hammered by the July advisories. If you're running AD with Samba's built-in DNS, the work here likely affects you.

DNS Gets Heavy Attention

Three bugs in this release focus on the internal DNS server. The first (BUG-15988) fixes a nasty habit where the server wouldn't fall back from UDP to TCP when responses exceeded 4 KB. RFC 7766 mandates this transition, and Samba was previously dropping or corrupting oversized responses. The second (BUG-16223) ensures DNS scavenging stops running on zones where administrators have explicitly set the fAging flag to FALSE. Stale-record cleanup firing on opted-out zones has caused outages in production before. The third (BUG-16226) resolves an error when applying aging configuration to the _msdcs.<domain> zone, which had been throwing WERR_INTERNAL_DB_ERROR.

On the client side, BUG-16225 tackles EDNS issues. Broken EDNS negotiation can lead to truncated answers or dropped responses, symptoms that often masquerade as network problems rather than a client bug. Volker Lendecke, Shachar Sharon, and Jennifer Sutton contributed to this one, suggesting a multi-round effort across the resolver code used by smbclient and NSS modules.

Beyond DNS: ACLs and Clusters

The remaining fixes aren't as glamorous but are arguably just as important for stability. BUG-16097 addresses a silent failure in the POSIX ACL backend. When processing NT ACLs with non-canonical ACE ordering, Samba was previously swallowing errors during translation. Windows clients could end up with stale permissions and no log entry to explain why. That's not great for debugging.

BUG-16082 fixes a cluster recovery issue where an inactive node could independently run recovery procedures, risking database inconsistencies in multi-node AD deployments. Martin Schwenke flagged this one. And BUG-16144 corrects stream create-disposition handling. If you rely on alternate data streams in your file shares, a previous bug could cause incorrect status codes or corrupted internal state when a stream handle was closed and reopened.

Stefan Metzmacher was the most active contributor with four fixes, three of which targeted DNS. The patchwork also includes work from Ralph Boehme, Andreas Schneider, and developers from Red Hat, Catalyst, and DDN. It's a reminder that Samba's development ecosystem still relies heavily on this collaborative model.

If you're itching for the bleeding edge, Samba published samba-4.25.0rc2 just three days ago on September 6. The 4.25 branch represents the next major development line. For production? Stick with 4.24. The advisory recommends staying on the current stable branch until a final 4.25.0 release is announced.

Head here to download the new release.