Samba ships 4.25.1 with a CVE hidden inside a routine bugfix
Samba fixed a genuine access-control bypass but skipped the formal security advisory, because the flaw lives in a feature barely anyone uses yet.
Samba 4.25.1 went live today as a normal point release, and it still carries a real access-control bypass. The part most readers will gloss over is that the team deliberately did not treat the fix as a security event.
No embargo. No dedicated advisory page. Samba folded CVE-2026-109411 straight into an ordinary bugfix and explained why in the release notes. The short version: the flaw lives entirely in vfs_ceph_rgw, a brand-new module that first shipped last month in 4.25.0. That means only 4.25.0 is affected, and only if you opted into a feature most deployments don't run.
Here's what the module actually does. vfs_ceph_rgw exports Ceph Object Gateway buckets as SMB shares, pretending object storage is a familiar folder tree with POSIX user and group IDs. It bridges two worlds that don't usually meet: file serving and object storage. Red Hat and IBM are the ones driving that convergence, which is arguably why the bug landed in their hands first.
The vulnerability itself is a case-insensitive open flaw. A client could access a file in a way that sidesteps the intended access checks. That's an access-control bypass, plain and simple. The release notes are explicit about the narrow scope, stating the flaw "only affects the recently released 4.25.0 version" and is confined to "the newly introduced vfs_ceph_rgw module." Fixers were Vinit Agnihotri of Red Hat and Anoop C S of Samba, tracked as Bug 16276.
Why no separate advisory?
It's a judgment call, and most of it holds up. A one-month-old, opt-in module carrying a vulnerability nobody would find on a typical server is a poor case for a full coordinated security embargo. Samba said the fix would just go out in the next regular point release. It's not a big deal worth a coordinated alert, but it is sensible given the blast radius.
The contrast is what makes this interesting. Look at Samba's security work this year and you'll see the opposite playbook. CVE-2026-1933, a reparse-point access-check failure scored 7.1 high, earned a formal security release. CVE-2026-58221, an LDAP flaw that let a low-privilege user take over a domain, sat at 8.8 and got the full coordinated treatment. OpenAI's security research group reported that one, a reminder that the people hunting Samba's bugs aren't always the usual suspects. Both affected widely used code and both hit Samba 4.21 and later. This CVE touched a sliver of a brand-new feature, so it took the fast, quiet route.
One aside worth keeping in mind: 4.25.1 itself carries no published CVSS score and no standalone advisory page at all. That's unusual for something the team still classified as a real access-control bypass.
The rest of the patch
Strip out the CVE and there are twelve more fixes, from eight contributors, and two themes stand out.
Clustering got hit hard. Three CTDB fixes from Martin Schwenke of DDN target real high-availability failures: nodes banned for trying recovery after losing the cluster lock, database operations landing on the wrong nodes, and a race in dynamic interface handling. If you run CTDB for high availability, this batch matters more than most.
Then there are build regressions from 4.25.0 itself. The just-released 4.25.0 failed to build on macOS and on 32-bit Linux i686, and both are now addressed. Volker Lende also fixed a couple of file-serving correctness bugs, including a rename-with-replace quirk that left duplicates behind instead of overwriting.
Red Hat shows up again as a heavy lifter across the batch, with Shweta Sodani and Priyanka Soni on logging and a macOS fruit size bug. That's a picture of who actually maintains Samba today: Red Hat, DDN, and serNet, each covering different slices of the stack.
Samba is the open-source bridge between Windows-networked clients and Unix-like servers, letting Linux machines hand out file and print services or stand up a full Active Directory domain controller. Andrew Tridgell first built it in 1991 as a PhD project, and the name came from grepping a dictionary for words containing S-M-B. That trivia matters less than the fact that it's on nearly every Linux distro and runs on macOS, BSD, and Solaris too.
If you're running 4.25.0 and actually use vfs_ceph_rgw, move to 4.25.1 today. Everyone else on a supported series (4.23, 4.24, 4.25) is already covered for the bigger flaws and just has the routine bugfixes to digest. Samba supports those three series right now, and 4.25.0 dropped September 24, so 4.25.1 is the second point release in that branch. It's not an LTS model: each series lasts about 18 months before dropping off support, running six weeks of point releases per branch in the meantime.
Head here to grab the tarball, and here to the full changelog.
