Samba 4.24.8 ships ten bug fixes, including an SMB3 signing hardening patch
The latest stable Samba patch lands with ten internal bug fixes, headlined by a change to SMB3 session-signing.
The Samba Team released 4.24.8 on October 12, the newest patch in the still-supported 4.24 stable series. It's a bug-fix drop, not a feature release. Ten issues tracked in Samba's own Bugzilla got closed out, touching security hardening, high-availability clustering, and plain protocol correctness.
Here's the part worth flagging first: none of these carry a CVE. That's deliberate. It sets 4.24.8 apart from the May 2026 security release, which shipped four real vulnerabilities across the 4.24, 4.23, and 4.22 lines. Those were disclosed exploits. What you're getting here is ten working bug reports, six contributors, and a healthy amount of quiet maintenance.
The headline fix touches SMB signing
The most security-relevant change is BUG 15962, a fix by Stefan Metzmacher that makes SMB3 Session Setup responses always signed.
SMB message signing is the primary defense against relay attacks, where an attacker forwards a victim's authentication to another server and slips in on the strength of stolen credentials. This change keeps those responses signed even in the messier edge cases, like guest or anonymous sessions that don't carry a signing key. Genuine anonymous sessions remain the documented exception per the SMB3 spec. For what it's worth, the real anti-relay value here is easy to understate.
Two other fixes touch things sysadmins actually feel in their bones. BUG 16200 and BUG 16261 both deal with file handling. In the first, Samba's veto-files feature pre-creates placeholder entries to stop clients from silently dropping files, but the function generating a unique numeric suffix could collide with an existing veto value. In the second, a rename regression meant that renaming Report.txt onto report.txt created a duplicate instead of replacing the file. Both violate expectations. Both are now fixed.
Clustering and crashes round out the list
The high-availability crowd gets two CTDB fixes, both by Martin Schwenke.
BUG 16254 addresses database operations that could be sent to the wrong node inside a cluster. BUG 16273 handles a nastier scenario where a node trying to recover after losing the cluster lock could end up banning itself. Either one leads to unnecessary failover, or worse.
The remaining stability fixes cover the denial-of-service surface. BUG 16081 is a crash in the winbind child message filter that only shows up when you've configured more than one domain connection. BUG 16240 produces a temporary directory name exceeding the filesystem's maximum length for otherwise-valid client names. BUG 16258 is a talloc memory issue in the Python configuration path when paired with CTDB.
Two more land in the configuration and logging bucket. BUG 16239 fixes parsing of uppercase "0X" hex values in the kdc default domain supported enctypes parameter, and it matters here specifically because that parameter now controls Samba's new AES-default Kerberos behavior. BUG 15857 makes backend logging actually honor the global log level, keeping audit trails from getting noisy.
Where this fits
Samba 4.24.8 sits inside the 4.24 series, which shipped its feature baseline on March 18, 2026. That release was notably security-first: AES Kerberos encryption is now the default, a "dollar ticket" impersonation defense got added, and PKINIT key-trust logon came online for Windows Hello for Business.
The AES-default change is exactly why BUG 16239 shows up in this patch. Fix the parser for that encryption-type parameter and you keep the whole hardening effort working.
It's also worth remembering where the series sits today. Samba 4.25.0 shipped September 24, 2026, as the current feature branch. The 4.24 line has moved into maintenance and security-support mode, but it keeps getting patches like this until end-of-life, which lands somewhere in 2027 to 2028. If you haven't migrated to 4.25 yet, still apply 4.24.8.
Samba has been through worse things than a routine patch, of course. Badlock, SambaCry, Zerologon. This release isn't any of those. It's the steady hum of infrastructure maintenance that keeps the lights on between the emergencies.
Head here to grab it from the stable directory at download.samba.org. The full release notes are available here.
