To verify a TSIG signed packet, the DNS server has to consider the contents of packet up until the TSIG record exactly in the form in which they were transmitted. This is happening after the initial NDR parsing, and the position of the TSIG record is not known, so we estimate it by forming a fake record using the TSIG data that we expect to have the size of the original record, and subtract the calculated size. If the TSIG record is using dns name compression, it will be reusing name components from previous records. The size estimate is not able to take account of this, resulting in an overestimate of the TSIG size, and an underestimate of the size of the signed part of the packet. This always results in a rejected packet, but if the name is compressed using nested or overlapping components it will end up with an underflow of packet_len at source4/dns_server/dns_verify.c:226 packet_len = in->length - tsig_blob.length; buffer_len = packet_len + fake_tsig_blob.length; buffer = talloc_zero_array(mem_ctx, uint8_t, buffer_len); if (buffer == NULL) { return WERR_NOT_ENOUGH_MEMORY; } memcpy(buffer, in->data, packet_len); memcpy(buffer + packet_len, fake_tsig_blob.data, fake_tsig_blob.length); which should result in a segfault. This code is only reached if the specially constructed compressed DNS name has already been registered in the TKEY cache, which as far as I know can only be done by an authenticated user. This was originally reported by Arjun Basnet of Securin. They assigned CVE-2026-6949, but after we expressed some doubt they withdrew the CVE. Further investigations by us revealed it was in fact exploitable.
CVSS3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 6.5 Denial of service by an unprivileged user.
We should still use CVE-2026-6949.
Created attachment 19002 [details] CVE-2026-6949-master.metze.01.patches.txt
Created attachment 19003 [details] CVE-2026-6949-master.metze.02.patches.txt
Also reported by Andrew Tridgell, as "DNS TSIG verification subtracts expanded reserialized record length from original packet length"
(In reply to Douglas Bagnall from comment #1) > CVSS3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 6.5 > > Denial of service by an unprivileged user. Actually, it is DoS by anonymous user (see bug 16115). So CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N 7.5
(In reply to Douglas Bagnall from comment #6) > CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N 7.5 I mean CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 7.5 ("I:N/A:H" not "I:H/A:N", same score).
Created attachment 19032 [details] advisory v1
Comment on attachment 19032 [details] advisory v1 CVE-2025-6949 => CVE-2026-6949
Created attachment 19068 [details] advisory v2
master patch applies as far back as 4.19.
adding vendors here. scheduled release 2026-07-28 10:00 UTC.
This bug was referenced in samba v4-24-stable (Release samba-4.24.5): a808c4eca63dc9af38cea84773431aa81ac25307 761796579873fab2909190a8f474a1d6d6f0caee
This bug was referenced in samba v4-23-stable (Release samba-4.23.10): d2ef0ce02c39fe11443692eb1fcbc63aaaa69e82 20798d41b7c3abc70a9f2652d96cb77809a10a01
This bug was referenced in samba v4-22-stable (Release samba-4.22.11): f754381c0b118a26295b466dd299a1ffaa88337c 323da8297ba1a6ffb1ad7cb609ac98d63cb622e0
This bug was referenced in samba v4-22-test: f754381c0b118a26295b466dd299a1ffaa88337c 323da8297ba1a6ffb1ad7cb609ac98d63cb622e0
This bug was referenced in samba v4-24-test: 36108895dde75514eddbea03f28b68eed3d9856e d003e6f3f873b420af0fc9e1eedde9841bb27a4d
This bug was referenced in samba v4-23-test: 58efc46783050b84e304e214529545f1de437d30 9c64d3675b4678807576d1e1e25e60f87885a86a
This bug was referenced in samba v4-24-test: a808c4eca63dc9af38cea84773431aa81ac25307 761796579873fab2909190a8f474a1d6d6f0caee
This bug was referenced in samba v4-23-test: d2ef0ce02c39fe11443692eb1fcbc63aaaa69e82 20798d41b7c3abc70a9f2652d96cb77809a10a01
This bug was referenced in samba master: b8751dc477c3c81b526a2a6c934b79b3b0cd2d50 61d8fe93c0167e6e9eb91a3f4bdffb242fa081c6
This bug was referenced in samba v4-23-stable (Release samba-4.23.11): 58efc46783050b84e304e214529545f1de437d30 9c64d3675b4678807576d1e1e25e60f87885a86a
This bug was referenced in samba v4-24-stable (Release samba-4.24.6): 36108895dde75514eddbea03f28b68eed3d9856e d003e6f3f873b420af0fc9e1eedde9841bb27a4d