<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<h3 style="margin-top: 20px; margin-bottom: 10px;">
Michael Tokarev pushed to branch master at <a href="https://salsa.debian.org/samba-team/samba">Debian Samba Team / samba</a>
</h3>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Commits:
</h4>
<ul>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/36108895dde75514eddbea03f28b68eed3d9856e">36108895</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-6949: ndr_dns: let ndr_pull_dns_res_rec() remember the start offset
In order to verify TSIG signatures we need a reliable way to
truncate the original dns_name_packet buffer before the
last additional dns_res_rec.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16083
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <dbagnall@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/d003e6f3f873b420af0fc9e1eedde9841bb27a4d">d003e6f3</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-6949: s4:dns_server: correctly truncate the buffer for TSIG verification
Calculating the length of the TSIG additional dns_res_rec,
via ndr_push_dns_res_rec() is fragile and may generate
a buffer larger than the original dns_name_packet buffer.
This could underflow the resulting packet_len,
to a very large value and buffer_len to a small value.
Resulting in a memcpy() of a very large size into
a very small buffer. This most likely already
gets a segmentation fault when reading after the
in->data.
This was reported by Arjun Basnet with Securin Labs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16083
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <dbagnall@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/006aa7f1f0f44a2d52d06a11b9e0f50d072e0936">006aa7f1</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
Protocol field lengths need to be validated to avoid attempts to
access memory beyond the end of the packet buffer.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/0954199e9bee58d44c7a35468a7f378fe7c7c2b9">0954199e</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocation
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed. Variable i
could be reused but that might be confusing, so leave any optimisation
to the compiler.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Martin Schwenke <mschwenke@ddn.com>
Reported-by: Also Andrew Tridgell (issue 22)
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/efeb84e1378583e170f3b6d95a27e7d389f040c2">efeb84e1</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-daemon: Avoid out-of-bounds data access
Do not allow the VNN map's size to extend past the end of the buffer.
This is checked by switching to ctdb_vnn_map_pull(), which also
simplifies the code.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/559cedfd8bb16485589bfb6dc6eb49d476ce6045">559cedfd</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
If a NUL terminator doesn't appear in the buffer then the database
name is not a valid string.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/82c81cfe1301590c5b43efc826640ceb96356756">82c81cfe</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The count can't exceed the recdata buffer size.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/d3b3de06c20fb6cabb798f01f7470caa79d0e116">d3b3de06</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The count can't exceed the indata buffer size.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/9771ccedd7c24c0cc01e69f713112eddbcaa407f">9771cced</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The first check is clearly needed because m->db_id is referenced. The
second check is handled by a similar update to
ctdb_control_update_record(), but repeat it in case something else
changes.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/8b5fc74bf1e19e18647da355a8985fb0f0cdab3a">8b5fc74b</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
Instead of checking only that there is enough data for the length
field, check there is enough data for the entire header part of the
struct. After cross-checking overall lengths, ensure there is enough
data for the key/data in the data element.
While here, modernise the DEBUG.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Andrew Tridgell (issue 13)
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/edc0d81e7f1a26fac05771d7cdf082ae60912959">edc0d81e</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-protocol: Avoid off-by-one error for bytes pulled
As per the comment, if there is no NUL byte in the buffer then don't
count one in the number of bytes pulled.
Note that this is unlikely to be a security issue because it would
take a protocol bug elsewhere to overrun the buffer. However, include
this fix here for posterity.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Andrew Tridgell (issue 16)
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/db9f000a4a3a7ac5b6d7083e9fa13dfaa025999e">db9f000a</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-protocol: Always pull the specified number of bytes
The string should not contain a premature NUL terminator, which would
cause less than the specified number of bytes to be pulled. If it
does, consume the specified number of bytes anyway. The alternative
doesn't make sense.
Note that this is unlikely to be a security issue, where trailing data
in the string field causes the buffer to be overrun. That would
require an additional protocol bug. However, include this fix here
for posterity.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/e9b205b929ac5d1eed4302ee2c96795f3fef81db">e9b205b9</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocations
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Reported-by: Andrew Tridgell (issue 22)
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/1b45e5849623a0b3e6ebaa0a522971f3d9f296bf">1b45e584</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocations
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/d658c91bc95dffc7409a482e1bde8573d7ccbd22">d658c91b</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-common: Secure sock_daemon Unix domain sockets
Currently, the mode of the socket depends on the creating process's
umask. This might allow unwanted access.
It might be preferable to do this just for the eventd socket.
However, there is no useful place to hook this in outside of
sock_daemon.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/49051f57566dd61f8c902c7a0f2bdf9e70674077">49051f57</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-doc: Emphasise that the private network must be private
Note that the difference in the first couple of lines is leading
whitespace being switch to a TAB.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/8c2c895f14ade62848a5b81883d786402f0183e8">8c2c895f</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58224: ctdb-common: Add comments to ward off vulnerability reports
We can't deal with this in the current CTDB protocol without
disproportionate effort. So, document reality clearly in the code to
try to stop these from being reported.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/d25f3ff0834daeb612e454e84ac325ed743f38ea">d25f3ff0</a></strong>
<div>
<span> by Douglas Bagnall </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58216: kdc:kpasswd: calculate correct size for password blob
We were making the enc_data_blob 6 bytes too big.
Its payload is an ASN.1 structure that knows its own size, so the
extra bytes are not usually read by Heimdal, but a crafted packet
could force them to be read.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16087
Reported-by: Tristan <TristanInSec@gmail.com>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/17f202d039c2ae584d8175e5e9d9b29fb8d5ec9d">17f202d0</a></strong>
<div>
<span> by Volker Lendecke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58218: dns_server: Fix an error path memleak
We talloc the new key off "dns->tkeys", which is long-lived. On any
error we never free'd that again. Probably not remotely triggerable,
this is only setting up the gensec context.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16115
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Douglas Bagnall <dbagnall@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/0d9ca2c5fcb799d0c8252bcad6c66e78cd4facc3">0d9ca2c5</a></strong>
<div>
<span> by Volker Lendecke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58218: dns_server: Only add a tkey after successful authentication
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16115
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Douglas Bagnall <dbagnall@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/ba8b65647603aff9c26d0d517af071119b7abab9">ba8b6564</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58221: s4:dsdb: provide dsdb_audit_{log_attributes,operation_human_readable}() functions
They are useful outside of audit_log.c soon.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16147
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/3661b112ab649c373d133727bb15066576a66ae6">3661b112</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58221: s4:dsdb: let rootdse_filter_operations() reject untrusted operations on special DNs
Without this authenticated (also non-admin) users write internal meta
data leading to admin privileges.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16147
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/18a2cf6f3cb16ad7aee3f2ce8241cda70247aa4a">18a2cf6f</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-58222: s4:ldap_server: don't allow untrusted compare requests for confidential attributes
This means we apply acl checks against the search filter similar
to normal ldb searches.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16148
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/44ba362ea3d9c2ecabccc00b60778a6e7fd5b128">44ba362e</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>WHATSNEW: Add release notes for Samba 4.24.5.
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/327a642f0f0196bb27048110fdd5115e30ac13a8">327a642f</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>VERSION: Disable GIT_SNAPSHOT for the 4.24.5 release.
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/2cb13ac138470ba202ad2217d0c6fd853fa6badb">2cb13ac1</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-07-28T10:46:39+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>VERSION: Bump version up to Samba 4.24.6...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/1247c61cb2ba39f420d114ab60a3dfa19853b6eb">1247c61c</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-28T12:14:16+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>ctdb-server: Avoid removing connections for released IP
Commit c6602b686b4e50d93272667ef86d3904181fb1ab causes TCP connections
to be cleared whenever an associated client goes away. This shouldn't
happen when the associated public IP is being released, since the
takeover node will need the connection details to send tickle ACKs.
Sorry, I missed this when reviewing that commit.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15994
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Wed Apr 29 02:58:12 UTC 2026 on atb-devel-224
(cherry picked from commit 9351c9f3b5a57239a7fbdd818e8ab72ecc469d9d)
Autobuild-User(v4-24-test): Björn Jacke <bjacke@samba.org>
Autobuild-Date(v4-24-test): Tue Jul 28 12:14:16 UTC 2026 on atb-devel-224
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/376df42eff1e9661ac172c5c499392f5ebcbeae1">376df42e</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-07-28T16:39:31+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Merge tag 'samba-4.24.5' into v4-24-test
samba: tag release samba-4.24.5
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/f65fc9702b5fe52c29842250f62dfa6e3196d3bc">f65fc970</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-29T11:08:15+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>ctdb-recoverd: Strengthen check for cluster lock held
This avoids attempting to start recovery without holding the cluster
lock.
There seems to be only one way the following can happen:
2026-05-12T12:15:51.127992+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:15:51.128019+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:15:51.128192+05:30 nsds1 ctdb-recoverd[826]: Attempting to take cluster lock (!/usr/libexec/ctdb/ctdb_mutex_fcntl_helper /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock 5 20)
2026-05-12T12:15:51.135578+05:30 nsds1 ctdbd[700]: ctdb_mutex_fcntl_helper: Unable to open /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock - (No such file or directory)
2026-05-12T12:15:51.135590+05:30 nsds1 ctdb-recoverd[826]: Unable to take cluster lock - unknown error
2026-05-12T12:15:56.130174+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:15:56.130206+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:15:56.130329+05:30 nsds1 ctdb-recoverd[826]: Attempting to take cluster lock (!/usr/libexec/ctdb/ctdb_mutex_fcntl_helper /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock 5 20)
2026-05-12T12:16:01.131882+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:16:01.131918+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:16:13.094308+05:30 nsds1 ctdbd[700]: ctdb_mutex_fcntl_helper: Unable to open /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock - (No such file or directory)
2026-05-12T12:16:13.094362+05:30 nsds1 ctdb-recoverd[826]: Unable to take cluster lock - unknown error
2026-05-12T12:16:13.094582+05:30 nsds1 ctdb-recoverd[826]: do_recovery: Starting do_recovery
2026-05-12T12:16:13.094591+05:30 nsds1 ctdb-recoverd[826]: Cluster lock not held - abort recovery, ban node
2026-05-12T12:16:13.094596+05:30 nsds1 ctdb-recoverd[826]: Banning node 0 for 300 seconds
2026-05-12T12:16:13.094612+05:30 nsds1 ctdbd[700]: Banning this node for 300 seconds
_cluster_lock_lock() sets rec->cluster_lock_handle during an attempt
to take the cluster look. This function contains a nested event loop
where other things can happen. Presumably the 3rd leader broadcast
timeout above occurs, starting a nested election (which also needs to
be avoided - this is the real root cause). cluster_lock_election()
then presumably finds that cluster_lock_held() returns true and sets
the leader to the current node.
However, the check in cluster_lock_held() is too weak and the "locked"
element must also be checked. As noted above, the nested elections
are the real issue but this is a belts-and-braces fix that should be
in place to avoid weirdness due to the nested event loop.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16152
Reported-by: Agam S <sagam@ddn.com>
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit c3c250c9c8e3385f593e386f91e8579b8c89370a)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/f26a49e67df2ac21a36acf7dcde605d7aefd618c">f26a49e6</a></strong>
<div>
<span> by Martin Schwenke </span> <i> at 2026-07-29T11:08:15+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>ctdb-recoverd: Do not allow nested elections
This appears to show nested elections:
2026-05-12T12:15:56.130174+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:15:56.130206+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:15:56.130329+05:30 nsds1 ctdb-recoverd[826]: Attempting to take cluster lock (!/usr/libexec/ctdb/ctdb_mutex_fcntl_helper /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock 5 20)
2026-05-12T12:16:01.131882+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:16:01.131918+05:30 nsds1 ctdb-recoverd[826]: Start election
There is no sign that the first election ended. Starting another one
causes bad state interactions. Apart from causing confusion for
multiple pieces of state (e.g. rec->election_in_progress), a nested
call to _cluster_lock_lock() will leak rec->cluster_lock_handle
because it will overwrite it with the new in-progress handle.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16152
Reported-by: Agam S <sagam@ddn.com>
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Thu Jul 9 15:24:42 UTC 2026 on atb-devel-224
(cherry picked from commit d28f8ed17c867f306ca900bd912e8b75c5c7be8b)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/00b044680d3484ac333d7bf227e183823ee23891">00b04468</a></strong>
<div>
<span> by Anoop C S </span> <i> at 2026-07-29T11:08:15+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>vfs_ceph_new: Include proxy setting in mount cache cookie
The mount cache cookie is derived from (conf_file/user_id/fsname) but
does not include the proxy mode. When two shares differ only in their
proxy setting, they produce the same cookie and share a single cached
ceph_mount_info. Since libcephfs.so and libcephfs_proxy.so define
struct ceph_mount_info with entirely different layouts, calling a
function resolved from one library on a mount allocated by the other
causes a segfault.
Add config->proxy to the cookie so that mounts created by different
libraries are never shared.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16186
Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: John Mulligan <jmulligan@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Fri Jul 24 15:56:49 UTC 2026 on atb-devel-224
(cherry picked from commit a1881f96f7309411087c3b4b3fe9db964a5ef644)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/0fa4d138772f11343b284ce4741f56fc7c2b013e">0fa4d138</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-07-29T11:08:15+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s3:rpc_server/dfs: fix temporary read of unrelated or non-existing memory
This was reported by Arjun Basnet with Securin Labs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16093
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
(cherry picked from commit 3b7730b3702875d92b5dc0e90410ae26c7355138)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/6d174ef3c6ec737f0883b073d6c8a47cf6e31c1e">6d174ef3</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-07-29T12:12:01+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s4:cracknames: make consistent use of ldb_binary_encode_string()
A client provided value can be passed into a filter
without going through ldb_binary_encode_string()
But the value is only appended via a to "name=%s",
so there's no leading "(", which means
in lib/ldb/common/ldb_parse.c:356: the value-parsing loop terminates
at the first unescaped ')', so a payload like "users)(hidden=*" collapses to
"(name=users)" with the trailing bytes silently discarded. An escaped "\)" makes
ldb_parse_tree() return NULL rather than admit injection. Combined with
LDB_SCOPE_ONELEVEL, the attribute list restricted to ["name"], and the fact that
a DRSUAPI-authenticated client can already issue arbitrary LDAP searches via
dcesrv_samdb_connect_as_user(), there is no escalation surface.
So this is only hardening helping AI to avoid reporting
false positives.
This was reported by Arjun Basnet with Securin Labs.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16094
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
(cherry picked from commit a7a5de8d951969d60a7f0c40798fc97f6ee873fa)
Autobuild-User(v4-24-test): Björn Jacke <bjacke@samba.org>
Autobuild-Date(v4-24-test): Wed Jul 29 12:12:01 UTC 2026 on atb-devel-224
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/d13c39c121ac06cfd71ae99de7d6ff8052eece14">d13c39c1</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2026-08-04T00:56:53+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Convert upstream signing-key to ascii
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/a2e0beedf76f6541e12c29788ab4bcdfc5004fed">a2e0beed</a></strong>
<div>
<span> by Matthias Grandl </span> <i> at 2026-08-11T18:16:21+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>vfs_ceph_snapshots: Fix panic on snapshot access with a "/"-rooted share
ceph_snap_gmt_convert_dir() builds an absolute snapshot path by joining
the share's connectpath, the request-relative name and the snapshot
subdir with '/' separators, then hands it to OpenDir(). OpenDir() ->
fd_openat() -> filename_convert_dirfsp_rel() splits the path on '/' and
openat_pathref_fsp_nosymlink() asserts that no component is empty:
SMB_ASSERT(rel_fname.base_name[0] != '\0') source3/smbd/files.c:1212
connectpath is a bare "/" when the share is mounted at the file system
root, so the join yields a leading "//" (e.g. "//.snap" or
"//dir/.snap"). That empty first component trips the assert and panics
smbd as soon as a snapshot is accessed.
Whether the malformed path actually reaches the assert also depends on
the Ceph client accepting a non-canonical "//" path in the preceding
stat(), so the panic is libcephfs-version dependent.
Canonicalize the .snap directory path with canonicalize_absolute_path()
after building it, so the path handed to OpenDir() is always canonical
and the empty leading component can no longer occur.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16176
Signed-off-by: Matthias Grandl <matthias.grandl@croit.io>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: David Disseldorp ddiss@samba.org
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Tue Jul 21 16:12:18 UTC 2026 on atb-devel-224
(cherry picked from commit abb48aacbd994877006bf9156e633d3cf29a34bc)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/2ec6b2cf753fe8ea572b7cd03fae813e52e7b67e">2ec6b2cf</a></strong>
<div>
<span> by Volker Lendecke </span> <i> at 2026-08-11T18:16:21+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>lib: Fix undefined behaviour at fork time in pthreadpool
If a pthread times out at the same time with a fork, ETIMEDOUT is
overwritten and not being taken care of. This means that we can race
with the forking thread destroying pool->condvar in the next round of
the thread's while(1) loop. pthread_cond_wait() on a condition
variable that has been destroyed is not a good idea.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16191
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Jul 30 17:51:29 UTC 2026 on atb-devel-224
(cherry picked from commit a13764ecad804539c8cad8ec84b41ef437fab4ac)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/692e4184ac40b37191f8809763de213fa3663897">692e4184</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-08-11T18:16:21+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s3:libsmb: let dsgetdcname_rediscover() try process_dc_dns() before process_dc_netbios()
It's 2026 we typically have AD domains, and most of the time no nmbd
running.
So we should try CLDAP before falling back name_status_find(),
this allows us to detect that the domain is an AD domain even if
we searched with the netbios domain name.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16153
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jul 2 09:33:10 UTC 2026 on atb-devel-224
(cherry picked from commit 8bd496bf937d3a38482943e973a196f2c1f902a9)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/22a00a2c125756c4654ef8e0f720f222ff3fecbc">22a00a2c</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2026-08-11T18:16:21+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s4/torture: add torture_smb2_connection_share_ext()
Takes an additional share paramter compared to torture_smb2_connection_ext().
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
(cherry picked from commit a6d8c56ccc6d3d0cd714fa90f0c3fa54e2231eb0)
[metze@samba.org] Backported in order to let the patches for bug 16065
apply cleanly.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16065
Signed-off-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/fda66e4274f9f846188b366e202b825a9e00bec8">fda66e42</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-08-11T18:16:21+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s4:py_net: make use of self->libnet_ctx->resolve_ctx
There's no need to call lpcfg_resolve_context() every time again.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16065
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit f5f80e04406b6f8e0cf810d7fd3d015e4e455051)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/1c1f97e4a1b2ad487c313e8a9adc1cfabc50fa12">1c1f97e4</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-08-11T18:16:21+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s4:libcli/resolve: let lpcfg_resolve_context() take an explicit mem_ctx
This avoids memory leaks in various places.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16065
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Sat Aug 1 09:11:02 UTC 2026 on atb-devel-224
(cherry picked from commit 44008810a4b81baa9cbf63f0960ae1310afbb2a0)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/c3c21e04faf96119e8e90d51ca450992f61b666c">c3c21e04</a></strong>
<div>
<span> by Ralph Boehme </span> <i> at 2026-08-11T18:16:21+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>selftest: mark "smb2.lease.two-leases" as flapping
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15978
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Björn Jacke <bjacke@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit df4271a19664fbb59a83d9d256cfa9e71836678d)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/4906c4d490523c0e6d81998ccada33953e780dc2">4906c4d4</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-08-11T18:16:21+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>selftest: mark RpcdWitnessSambaTests as flapping
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16077
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit a871fae0b94fae5b052f14ae06cf3400b4a0ef33)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/71c1e9f2f8604a956a6127d2908a4b960df8b93c">71c1e9f2</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-08-11T19:19:29+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>python/tests: catch NT_STATUS_IO_TIMEOUT from witness.witness() as AssertionError()
This way it's actually possible to mark it as flapping
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16077
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Björn Jacke <bjacke@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon Aug 10 16:42:23 UTC 2026 on atb-devel-224
(cherry picked from commit f16269a6fc586071da81052ee4e76827e5b774be)
Autobuild-User(v4-24-test): Björn Jacke <bjacke@samba.org>
Autobuild-Date(v4-24-test): Tue Aug 11 19:19:29 UTC 2026 on atb-devel-224
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/453e1622ad3b311310735bcb53c2e328962f84e1">453e1622</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-08-12T22:47:59+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>librpc/ndr: fix ndr_{push,pull,print}_{timeval,timespec}() and add _legacy() compat
Scalar types should do nothing when called with NDR_BUFFERS,
the current timeval and timespec encode the values twice.
In order to keep compat with the former behavior we have
timeval_legacy and timespec_legacy.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16199
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 270c2451b541d6457d17b5eeccaafd32636b4591)
Autobuild-User(v4-24-test): Björn Jacke <bjacke@samba.org>
Autobuild-Date(v4-24-test): Wed Aug 12 22:47:59 UTC 2026 on atb-devel-224
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/94ca0ffe0eb4d3653e9a145ceac51db612afe099">94ca0ffe</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-08-13T16:22:15+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>WHATSNEW: Add release notes for Samba 4.24.6.
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/f6577b760995c2bffa44c50650e8d0fbe1807f0b">f6577b76</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-08-13T16:22:54+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>VERSION: Disable GIT_SNAPSHOT for the 4.24.6 release.
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/8a42272116df66345d0ce66ea3833c62d396ed79">8a422721</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2026-08-13T19:12:05+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 4.24.6+dfsg</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/6cfaaff313d7f80385715483082408c50636f3f4">6cfaaff3</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2026-08-13T19:12:20+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Update upstream source from tag 'upstream/4.24.6+dfsg'
Update to upstream version '4.24.6+dfsg'
with Debian dir 515650e1823515a9c12f6239c548e44e9c7ec4f9</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/b01ac367657727d030c360827247f452f03853e2">b01ac367</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2026-08-13T19:15:15+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>update changelog; upload version 4.24.6+dfsg-1 to unstable
</pre>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
71 changed files:
</h4>
<ul>
<li class="file-stats">
<a href="#b33892fbddeffc3368077b4904ad0b3d562a7312">
VERSION
</a>
</li>
<li class="file-stats">
<a href="#3277e12b5a9f9ff632d229e2629d34ad21dd93fc">
WHATSNEW.txt
</a>
</li>
<li class="file-stats">
<a href="#83364e6cb4542630ffc8a02500ad781175c71225">
ctdb/server/ctdb_recoverd.c
</a>
</li>
<li class="file-stats">
<a href="#a29926ff0172b1ba3cd620f89b910e1d65b7af8e">
ctdb/server/ctdb_takeover.c
</a>
</li>
<li class="file-stats">
<a href="#9c96da0e9f91d7d8937b69b524702c106258f0d1">
debian/changelog
</a>
</li>
<li class="file-stats">
<a href="#e51cf6f765f87e9fa07041f04d054fe14e7a054f">
debian/upstream/signing-key.asc
</a>
</li>
<li class="file-stats">
<a href="#800bbb7e68441d7504884aead42c914d1f3d744b">
lib/pthreadpool/pthreadpool.c
</a>
</li>
<li class="file-stats">
<a href="#47affa4b70b88016d1c1bf565b4e0ddd4d11e813">
libcli/echo/tests/echo.c
</a>
</li>
<li class="file-stats">
<a href="#cc90f2d8e96e97d371a9941f8393c2e7a2d7c381">
<span class="new-file">
+
librpc/ABI/ndr-6.1.0.sigs
</span>
</a>
</li>
<li class="file-stats">
<a href="#3fec41a2f8a647242f7c45f8aa9b8f003529fa23">
librpc/idl/misc.idl
</a>
</li>
<li class="file-stats">
<a href="#4f414ddfc8bc113f2ce62ed72afe6bc60bb035ed">
librpc/ndr/libndr.h
</a>
</li>
<li class="file-stats">
<a href="#4ce1b7450397ae502289d3b4165f2ec39fe3211a">
librpc/ndr/ndr_basic.c
</a>
</li>
<li class="file-stats">
<a href="#cb0c65b14141d24f5743647f759828516df05ae6">
librpc/wscript_build
</a>
</li>
<li class="file-stats">
<a href="#ca6d1bcb0a5c8775f6f0e80000e008e215e59fab">
nsswitch/libwbclient/tests/wbclient.c
</a>
</li>
<li class="file-stats">
<a href="#99a1f61fe428d04e71194430a1f42bd58f57047c">
python/samba/tests/blackbox/rpcd_witness_samba_only.py
</a>
</li>
<li class="file-stats">
<a href="#f6038275e1812b33a3897c88f1742b9ff2a090e2">
selftest/flapping.d/smb2.lease
</a>
</li>
<li class="file-stats">
<a href="#33790b08db7119ce1fa544558edf7dd85b299588">
<span class="new-file">
+
selftest/flapping.d/witness
</span>
</a>
</li>
<li class="file-stats">
<a href="#3a5614d46af940d82b6af30a232af784bc45211e">
source3/librpc/idl/open_files.idl
</a>
</li>
<li class="file-stats">
<a href="#ccfb4bdef1ad1093961317ad93066141c2e2571f">
source3/libsmb/dsgetdcname.c
</a>
</li>
<li class="file-stats">
<a href="#28998af1bd785989c4b21618e105d3497c3ff0fd">
source3/modules/vfs_ceph_new.c
</a>
</li>
<li class="file-stats">
<a href="#44812ed69320477023caef24a3dc08638e0a5d79">
source3/modules/vfs_ceph_snapshots.c
</a>
</li>
<li class="file-stats">
<a href="#c391fe46abec5f3334267d06c8ec199bc3a06636">
source3/rpc_server/dfs/srv_dfs_nt.c
</a>
</li>
<li class="file-stats">
<a href="#6691ac1f75ca14f8594f78ec956438225f231022">
source4/client/cifsdd.c
</a>
</li>
<li class="file-stats">
<a href="#c90c043746b7842f85c6938e8e5b2b6590a0dbc7">
source4/client/client.c
</a>
</li>
<li class="file-stats">
<a href="#7ce382f165479f75eb25425465f18f03b4a5d7f8">
source4/dsdb/ft_scanner/ft_scanner_tdos.c
</a>
</li>
<li class="file-stats">
<a href="#eb9fa364df189a3bbc4c08a66ccbb7d899f9d53b">
source4/dsdb/samdb/cracknames.c
</a>
</li>
<li class="file-stats">
<a href="#70e8824febd4f9aaf12d7099648e07dc91eb0010">
source4/kdc/kdc-proxy.c
</a>
</li>
<li class="file-stats">
<a href="#175e1df3624fc2b3713fa35e83966cd7ed1d71d9">
source4/lib/policy/gp_filesys.c
</a>
</li>
<li class="file-stats">
<a href="#6118ace3814ae6d868d84bfa203984f943d1ff9d">
source4/libcli/ldap/ldap_client.c
</a>
</li>
<li class="file-stats">
<a href="#852fdcb6d03d7f82fc9cda3d2b599b898046ee50">
source4/libcli/resolve/resolve_lp.c
</a>
</li>
<li class="file-stats">
<a href="#dba93c8c4ec0ea5f410ca225bdfb81cfb30ba043">
source4/libnet/libnet.c
</a>
</li>
<li class="file-stats">
<a href="#86bdfc510623c798db0e9941d1961f15fa5044c3">
source4/libnet/libnet_site.c
</a>
</li>
<li class="file-stats">
<a href="#ca182a9aa04554566ce74a7e0b43a7db3504f144">
source4/libnet/py_net.c
</a>
</li>
<li class="file-stats">
<a href="#032e7bd4933f51ceeae341cea3b32004958d2fb5">
source4/librpc/rpc/dcerpc_connect.c
</a>
</li>
<li class="file-stats">
<a href="#ef01afd96b601c24d43753a1e962146144e0e6b4">
source4/ntvfs/cifs/vfs_cifs.c
</a>
</li>
<li class="file-stats">
<a href="#deadcdd9a82568e3667a3520c2db3fcc7272ff5a">
source4/torture/basic/base.c
</a>
</li>
<li class="file-stats">
<a href="#caabab8038b8e87841d8f218de10a54a68daed39">
source4/torture/basic/misc.c
</a>
</li>
<li class="file-stats">
<a href="#f18d7d47d759d5a36800354d4b0ff2d40ebb6e17">
source4/torture/drs/rpc/dssync.c
</a>
</li>
<li class="file-stats">
<a href="#d0d9483a4ec979813b5a283f46bd0ed77e889019">
source4/torture/gentest.c
</a>
</li>
<li class="file-stats">
<a href="#c91c90b7bf9c3da350e23bcef96f7924f6e31ec9">
source4/torture/ldap/cldap.c
</a>
</li>
<li class="file-stats">
<a href="#5712ac78e600f64be12cdd72c6bc2de85b2992d1">
source4/torture/ldap/cldapbench.c
</a>
</li>
<li class="file-stats">
<a href="#4284b7f6a18e1bbcab9533dc106589e7255aac80">
source4/torture/ldap/netlogon.c
</a>
</li>
<li class="file-stats">
<a href="#06cee9929500deea3489b6eeec8e7f9d515c86eb">
source4/torture/libnet/libnet_BecomeDC.c
</a>
</li>
<li class="file-stats">
<a href="#99422deff675b983b754c0973938497d34eb7460">
source4/torture/locktest.c
</a>
</li>
<li class="file-stats">
<a href="#b7fcb20e52bcdb10abb17d2fb1df2796e201f483">
source4/torture/masktest.c
</a>
</li>
<li class="file-stats">
<a href="#8c439a6b0cfebeaae7baa3e1e4caebc000852940">
source4/torture/nbt/dgram.c
</a>
</li>
<li class="file-stats">
<a href="#a751fbaacb906422cdb42ef7367434879d917454">
source4/torture/nbt/nbt.c
</a>
</li>
<li class="file-stats">
<a href="#cb071847ab42a7a3591d29b0f7ee3ef3f5c19bfb">
source4/torture/raw/composite.c
</a>
</li>
<li class="file-stats">
<a href="#95d6769d03305d78280a17daa02ac993555a6127">
source4/torture/raw/lockbench.c
</a>
</li>
<li class="file-stats">
<a href="#a8a3f4abe2f5c0185398282e7e28dfc7a8880957">
source4/torture/raw/openbench.c
</a>
</li>
<li class="file-stats">
<a href="#b660335c06adbfdac930827c18960dda20a2a26d">
source4/torture/raw/oplock.c
</a>
</li>
<li class="file-stats">
<a href="#5f5a739bf7a206dd8fb01543e86a44a51dce1401">
source4/torture/raw/session.c
</a>
</li>
<li class="file-stats">
<a href="#d527e0ee14fe4cb637bd21289c0dc1fb60e7e2ef">
source4/torture/raw/tconrate.c
</a>
</li>
<li class="file-stats">
<a href="#974cb58aca282e5eb89cbdd5d5bc88fb573c1549">
source4/torture/rpc/fsrvp.c
</a>
</li>
<li class="file-stats">
<a href="#18bbce44ab5d2e659e6041a4bec671b04cc7cdcc">
source4/torture/rpc/iremotewinspool_driver.c
</a>
</li>
<li class="file-stats">
<a href="#ae49101c534e07a1bedec1b27eb17e0e030d4262">
source4/torture/rpc/join.c
</a>
</li>
<li class="file-stats">
<a href="#472dd7cc051f87d4c4f6d2fadc70f8c9fdf94605">
source4/torture/rpc/lsa.c
</a>
</li>
<li class="file-stats">
<a href="#07ea075ac75d02699b3fd48e050668be214351bf">
source4/torture/rpc/samba3rpc.c
</a>
</li>
<li class="file-stats">
<a href="#aeaac340557fe2d29c507a49c97e646d7540e1de">
source4/torture/rpc/spoolss.c
</a>
</li>
<li class="file-stats">
<a href="#9399b3eb512b4aaf9864470ae3d8935c3e6d89ab">
source4/torture/smb2/credits.c
</a>
</li>
<li class="file-stats">
<a href="#a9e92f7624ae0462fd0a28956481b3efb5bc3a21">
source4/torture/smb2/durable_open.c
</a>
</li>
<li class="file-stats">
<a href="#eb21cd73e6278a9497b3654221012eead05f8717">
source4/torture/smb2/ioctl.c
</a>
</li>
<li class="file-stats">
<a href="#cd23f40df56adaed74e70eaafbbe0775f7a2d9b0">
source4/torture/smb2/multichannel.c
</a>
</li>
<li class="file-stats">
<a href="#8a9f33821702df41d7b9157c723bfe71b400b7e7">
source4/torture/smb2/oplock.c
</a>
</li>
<li class="file-stats">
<a href="#3fb0d98dfb1b7e1027af0961890a717329be6173">
source4/torture/smb2/replay.c
</a>
</li>
<li class="file-stats">
<a href="#63ef1bd27853af71f2d82d15d55bd21970e0d94c">
source4/torture/smb2/scan.c
</a>
</li>
<li class="file-stats">
<a href="#911552681214e3d7ffb5b586f0f61d09dbb2db5b">
source4/torture/smb2/session.c
</a>
</li>
<li class="file-stats">
<a href="#31c19a257b4d89ce136cb5c1c4bf350d66d2c52d">
source4/torture/smb2/util.c
</a>
</li>
<li class="file-stats">
<a href="#c68e0672c915f7d7776a230b04a2e206210ebea6">
source4/torture/unix/unix_info2.c
</a>
</li>
<li class="file-stats">
<a href="#48ce2361d7c54ded19aa70938fec76c851d25ed8">
source4/torture/unix/whoami.c
</a>
</li>
<li class="file-stats">
<a href="#d6178587e5f84bb98cc5e76237caed9aadb36239">
source4/torture/util_smb.c
</a>
</li>
</ul>
<h5 style="margin-top: 10px; margin-bottom: 10px; font-size: .875rem;">
The diff was not included because it is too large.
</h5>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
<a href="https://salsa.debian.org/samba-team/samba/-/compare/e265ca1ad77bb839cf3ee1d97d5a279bcddc813a...b01ac367657727d030c360827247f452f03853e2">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://salsa.debian.org">salsa.debian.org</a>. <a href="https://salsa.debian.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://salsa.debian.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://salsa.debian.org/samba-team/samba/-/compare/e265ca1ad77bb839cf3ee1d97d5a279bcddc813a...b01ac367657727d030c360827247f452f03853e2 at 1786637801
</span>
</p>
</div>
</body>
</html>