16039 – July 2026 security meta-bug

Bug 16039 - July 2026 security meta-bug

Summary: July 2026 security meta-bug

Status:	RESOLVED FIXED

Alias:	None

Product:	Samba 4.1 and newer
Classification:	Unclassified
Component:	Other (show other bugs)
Version:	unspecified
Hardware:	All All

Importance:	P5 normal (vote)
Target Milestone:	---
Assignee:	Samba QA Contact
QA Contact:	Samba QA Contact

URL:
Keywords:

Depends on:	CVE-2026-6949 CVE-2026-58224 CVE-2026-58216 CVE-2026-58218 CVE-2026-58221 CVE-2026-58222
Blocks:
	Show dependency tree / graph

Reported:	2026-03-22 00:46 UTC by Douglas Bagnall
Modified:	2026-07-29 08:22 UTC (History)
CC List:	3 users (show)

See Also:	16099

Attachments
combined patch for master (71.76 KB, patch) 2026-07-14 22:58 UTC, Douglas Bagnall	dbagnall: ci-passed+	Details
combined patch for 4.24 v1 (71.79 KB, patch) 2026-07-14 22:59 UTC, Douglas Bagnall	dbagnall: ci-passed+	Details
combined patch for 4.23 v1 (62.09 KB, patch) 2026-07-14 22:59 UTC, Douglas Bagnall	dbagnall: ci-passed+	Details
combined patch for 4.22 v1 (62.09 KB, patch) 2026-07-14 23:00 UTC, Douglas Bagnall	dbagnall: ci-passed+	Details
bundle for master v2 (73.06 KB, patch) 2026-07-15 13:34 UTC, Björn Jacke	metze: review-	Details
bundle for 4.24 v2 (73.04 KB, patch) 2026-07-15 13:35 UTC, Björn Jacke	metze: review-	Details
bundle for 4.23 v2 (63.28 KB, patch) 2026-07-15 13:35 UTC, Björn Jacke	metze: review-	Details
bundle for 4.22 v2 (63.39 KB, patch) 2026-07-15 13:36 UTC, Björn Jacke	metze: review-	Details
combined patch for master v3 (73.06 KB, patch) 2026-07-15 18:41 UTC, Björn Jacke	dbagnall: review+	Details
combined patch for 4.24 v3 (73.09 KB, patch) 2026-07-15 18:41 UTC, Björn Jacke	dbagnall: review+	Details
combined patch for 4.23 v3 (63.43 KB, patch) 2026-07-15 18:42 UTC, Björn Jacke	dbagnall: review+	Details
combined patch for 4.22 v3 (63.43 KB, patch) 2026-07-15 18:42 UTC, Björn Jacke	dbagnall: review+	Details
backport for v4.16 (63.46 KB, patch) 2026-07-21 03:58 UTC, Douglas Bagnall	jsutton: review+ dbagnall: ci-passed+	Details
backport for 4.17 lts (63.46 KB, patch) 2026-07-21 03:59 UTC, Douglas Bagnall	jsutton: review+ dbagnall: ci-passed+	Details
Show Obsolete (8) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Douglas Bagnall 2026-03-22 00:46:17 UTC

Comment 3 Stefan Metzmacher 2026-07-09 09:05:56 UTC

Given, the most important ones are ready, when should we decide that
we defer others?

Comment 5 Douglas Bagnall 2026-07-10 02:13:25 UTC

(In reply to Stefan Metzmacher from comment #3)
What about we have cut-off next week and go to vendors a day or two after that, if the combined CI branches work.

Comment 6 Björn Jacke 2026-07-10 14:15:32 UTC

sounds like a good plan

Comment 7 Douglas Bagnall 2026-07-14 21:36:51 UTC

Now we have

bug                                              | patch        | advisory
-------------------------------------------------|--------------|-------------------
bug 16083 CVE-2026-6949  TSIG name compression   | √√√          | √ 
bug 16085 CVE-2026-58224 CTDB oob packet lengths | √√√          | √
bug 16087 CVE-2026-58216 kpasswd oob read        | √√√          | √
bug 16115 CVE-2026-58218 TKEY DoS                | √√√          | √
bug 16147 CVE-2026-58221 LDAP special DNs        | √√√          | √
bug 16148 CVE-2026-58222 LDAP compare injection  | √√√          | √

Comment 8 Douglas Bagnall 2026-07-14 22:58:43 UTC

Created attachment 19092 [details]
combined patch for master

Comment 9 Douglas Bagnall 2026-07-14 22:59:16 UTC

Created attachment 19093 [details]
combined patch for 4.24 v1

Comment 10 Douglas Bagnall 2026-07-14 22:59:49 UTC

Created attachment 19094 [details]
combined patch for 4.23 v1

Comment 11 Douglas Bagnall 2026-07-14 23:00:15 UTC

Created attachment 19095 [details]
combined patch for 4.22 v1

Comment 12 Stefan Metzmacher 2026-07-15 08:08:33 UTC

Björn can you please add the CVE tags and reviewed-by tags to the combined
patches where missing and upload them as v2? Then I can do some final checking.

Comment 13 Björn Jacke 2026-07-15 13:34:53 UTC

Created attachment 19102 [details]
bundle for master v2

Comment 14 Björn Jacke 2026-07-15 13:35:27 UTC

Created attachment 19103 [details]
bundle for 4.24 v2

Comment 15 Björn Jacke 2026-07-15 13:35:48 UTC

Created attachment 19104 [details]
bundle for 4.23 v2

Comment 16 Björn Jacke 2026-07-15 13:36:48 UTC

Created attachment 19105 [details]
bundle for 4.22 v2

Comment 17 Stefan Metzmacher 2026-07-15 16:11:58 UTC

Comment on attachment 19102 [details]
bundle for master v2

CVE-2026-6949: s4:dns_server: correctly truncate the buffer for TSIG verification 
needs Reviewed-by: Douglas Bagnall dbagnall@samba.org instead of signed-off

The commits for CVE-2026-58221 und CVE-2026-58222 should have ':' after the CVE
number.

The backports are a bit inconsistent and have missing BUG lines or wrong/different reviewed-by tags. Once the master patchset is fixed the backports
should be adjusted.

I typically use something like this:
diff -Npur master.patch bug-16039-v4-24-combined.patch | colordiff | less -R
diff -Npur bug-16039-v4-24-combined.patch bug-16039-v4-23-combined.patch | colordiff | less -R
diff -Npur bug-16039-v4-23-combined.patch bug-16039-v4-22-combined.patch | colordiff | less -R

Comment 19 Björn Jacke 2026-07-15 18:41:15 UTC

Created attachment 19106 [details]
combined patch for master v3

Comment 20 Björn Jacke 2026-07-15 18:41:38 UTC

Created attachment 19107 [details]
combined patch for 4.24 v3

Comment 21 Björn Jacke 2026-07-15 18:42:28 UTC

Created attachment 19108 [details]
combined patch for 4.23 v3

Comment 22 Björn Jacke 2026-07-15 18:42:57 UTC

Created attachment 19109 [details]
combined patch for 4.22 v3

Comment 23 Björn Jacke 2026-07-17 13:39:50 UTC

Adding our vendors to cc of this security release meta bug.

This critical security release is scheduled for Tuesday, 2026-07-28 10:00 UTC.

Comment 24 Douglas Bagnall 2026-07-21 03:58:30 UTC

Created attachment 19123 [details]
backport for v4.16

Comment 25 Douglas Bagnall 2026-07-21 03:59:34 UTC

Created attachment 19124 [details]
backport for 4.17 lts