Samba pam_winbind CVE-2026-15779

Three specific conditions must concurrently exist: (1) pam_winbind must be configured with mkhomedir enabled in the PAM stack (a non-default but common configuration in AD-integrated deployments); (2) the target account must have its home directory set to '/' or another critical system path - the description explicitly notes this is a common default for system/service accounts sourced from AD or LDAP; and (3) the attacker must hold a sudo delegation allowing them to execute at least one command as that system account, OR be operating as root. Exploitation is limited to local access only (AV:L) - no network-facing attack surface exists. The impact is further limited by the 0555 permissions on '/' on RHEL, which prevent the new owner from writing to the root directory, confining the outcome to availability loss rather than write-access privilege escalation. Systems that do not use pam_winbind, do not enable mkhomedir, or do not have any accounts with '/' as home directory are not exploitable.

The CVSS 3.1 base score of 6.1 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H accurately reflects the local-only attack surface and high-severity availability impact. The low attack complexity (AC:L) is consistent with the description's framing that system accounts with '/' as their home directory are a common default, making the necessary preconditions frequently present in AD-integrated RHEL environments. PR:L correctly captures that the trigger requires only a low-privilege user holding a specific sudo delegation - not full root access - expanding the realistic attacker pool beyond administrators. The A:H rating is well-substantiated: ownership change on '/' breaks SSH daemon operation, sudo invocation, and package manager functionality, effectively rendering the system unmanageable remotely. The I:L rating reflects the ownership reassignment itself (a metadata integrity change) without granting write capability, which is constrained by the 0555 permissions RHEL ships on '/'. No EPSS data was provided, and the CVE is not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis. Despite the moderate CVSS score, the real-world priority in AD-integrated RHEL environments with mkhomedir enabled should be treated as elevated due to the potential for a non-root actor to cause catastrophic availability loss requiring physical or out-of-band recovery.

A local user on an AD-integrated RHEL system who holds a sudo rule permitting them to run a specific command as the 'backup' service account (whose LDAP-sourced home directory is '/') executes that sudo command, triggering PAM authentication for the 'backup' account. pam_winbind's mkhomedir logic fires, calls chown on '/' to assign ownership to the backup account's UID, and from that point SSH, sudo, and yum/dnf fail system-wide because those tools enforce root ownership on critical filesystem paths, requiring console or out-of-band access for recovery.