Samba 4.25.1 has been released, addressing a critical access-control bypass flaw (CVE-2026-109411) found in the newly introduced vfs_ceph_rgw module, which affects only users who opted into this feature. The Samba team chose not to issue a formal security advisory or embargo for this CVE due to its limited scope and the rarity of the module's usage, unlike other significant vulnerabilities that received more attention this year. In addition to the CVE fix, the release includes twelve other bug fixes, particularly aimed at CTDB clustering issues and build regressions from the previous version. Users of version 4.25.0 who utilize vfs_ceph_rgw are encouraged to upgrade immediately, while others on supported versions will receive standard bugfix updates

Samba 4.25.1 Release: CVE Fixed Without Security Advisory

Samba 4.25.1 shipped today as a routine point release, but it fixes a genuine access-control bypass flagged as CVE-2026-109411. The team deliberately skipped a coordinated security embargo because the flaw lives only in vfs_ceph_rgw, a module that landed just last month in 4.25.0 and that most servers don't use. Beyond the CVE, the patch bundles twelve more fixes, including three CTDB clustering fixes and build regressions from 4.25.0. Anyone on 4.25.0 using vfs_ceph_rgw should upgrade now, while all 4.23, 4.24, and 4.25 users get the usual bugfix updates.

Samba 4.25.1 Release: CVE Fixed Without Security Advisory @ Linux Compatible