CVE-2026-58218
Fixed in a distro release EPSS <1%CVSS 5.3
A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | samba | no fix |
| Debian 13 | samba | 2:4.22.10+dfsg-0+deb13u2 |
| Debian 14 | samba | 2:4.24.5+dfsg-1 |
| SUSE Enterprise Storage 7.1 | samba | 4.15.13+git.808.eeca19f5e1-150300.3.106.1 |
| SUSE Linux Enterprise High Availability Extension 12 SP5 | samba | 4.15.13+git.729.a8ce057e8d-3.109.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP4 | samba | 4.15.13+git.808.eeca19f5e1-150400.3.52.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP5 | samba | 4.17.12+git.581.f49579c6cd-150500.3.42.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP6 | samba | 4.19.8+git.501.67274891bc-150600.3.29.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP7 | samba | 4.21.10+git.533.31d7e5508d-150700.3.29.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | samba | 4.15.13+git.808.eeca19f5e1-150400.3.52.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | samba | 4.15.13+git.808.eeca19f5e1-150400.3.52.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | samba | 4.17.12+git.581.f49579c6cd-150500.3.42.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | samba | 4.17.12+git.581.f49579c6cd-150500.3.42.1 |
| SUSE Linux Enterprise Micro 5.3 | samba | 4.15.13+git.808.eeca19f5e1-150400.3.52.1 |
| SUSE Linux Enterprise Micro 5.4 | samba | 4.15.13+git.808.eeca19f5e1-150400.3.52.1 |
| SUSE Linux Enterprise Micro 5.5 | samba | 4.17.12+git.581.f49579c6cd-150500.3.42.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | samba | 4.21.10+git.533.31d7e5508d-150700.3.29.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | samba | 4.15.13+git.729.a8ce057e8d-3.109.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | samba | 4.15.13+git.808.eeca19f5e1-150400.3.52.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | samba | 4.17.12+git.581.f49579c6cd-150500.3.42.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | samba | 4.19.8+git.501.67274891bc-150600.3.29.1 |
| SUSE Linux Enterprise Server 16.0 | samba | 4.22.11+git.552.66cfeb7de0a-160000.1.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | samba | 4.15.13+git.729.a8ce057e8d-3.109.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | samba | 4.15.13+git.808.eeca19f5e1-150400.3.52.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | samba | 4.17.12+git.581.f49579c6cd-150500.3.42.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | samba | 4.19.8+git.501.67274891bc-150600.3.29.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | samba | 4.22.11+git.552.66cfeb7de0a-160000.1.1 |
| SUSE Linux Micro 6.2 | samba | 4.22.11+git.552.66cfeb7de0a-160000.1.1 |
| SUSE Linux Micro 6.2 | samba | 4.22.9+git.538.af6cb4fb2e-160000.1.1 |
| Ubuntu 22.04 LTS | samba | 2:4.15.13+dfsg-0ubuntu1.13 |
| Ubuntu 24.04 LTS | samba | 2:4.19.5+dfsg-4ubuntu9.7 |
| Ubuntu 26.04 LTS | samba | 2:4.23.6+dfsg-1ubuntu2.2 |
| Ubuntu Pro 14.04 LTS | samba | no fix |
| Ubuntu Pro 16.04 LTS | samba | no fix |
| Ubuntu Pro 18.04 LTS | samba | no fix |
| Ubuntu Pro 20.04 LTS | samba | no fix |
| openSUSE Leap 16.0 | samba | 4.22.9+git.538.af6cb4fb2e-160000.1.1 |
| openSUSE Leap 16.0 | samba | 4.22.11+git.552.66cfeb7de0a-160000.1.1 |
| openSUSE Tumbleweed | samba | 4.24.5+git.481.dba78dbdea-1.1 |