CVE-2026-3238: 
Samba vulnerability analysis and mitigation

CVE-2026-3238 is a NULL pointer dereference vulnerability in Samba's WINS (Windows Internet Naming Service) server component when Samba is configured as an Active Directory Domain Controller (AD DC). An unauthenticated remote attacker can send specially crafted UDP packets targeting the WINS service to trigger a crash, resulting in a denial of service. All Samba versions since 4.0 are affected. The vulnerability was discovered by researchers from the DREAM Security Research Team (Arad Inbar, Erez Cohen, Nir Somech, and Ben Grinberg) and publicly disclosed on June 8, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Samba Advisory, Github Advisory).

The root cause is a NULL pointer dereference (CWE-476) in the WINS protocol handlers for the RELEASE and MULTI_HOME_REG packet types within Samba's AD DC WINS server implementation. These handlers fail to properly validate incoming packets before dereferencing pointers, allowing an attacker to trigger a crash by sending malformed UDP packets to the WINS service port (UDP 137). Exploitation requires no authentication and no user interaction, and the attack can be performed remotely over the network with low complexity. A key precondition is that the WINS server must be explicitly enabled via wins support = yes in the [global] section of smb.conf — it is not active by default. The simplicity of the attack makes it trivial to keep the WINS service continuously unavailable, as the service restarts at increasing intervals (Samba Advisory, Red Hat Bugzilla).

Successful exploitation results in a denial of service against the WINS server component of a Samba AD DC, causing it to crash. Because the service restarts at increasing intervals, a persistent attacker can effectively render the WINS service completely unavailable. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. Environments relying on WINS for NetBIOS name resolution in their Active Directory infrastructure may experience disruption to name resolution services (Samba Advisory, Github Advisory).

1. Reconnaissance: Identify Samba AD DC instances with WINS support enabled by scanning for UDP port 137 (NetBIOS Name Service) using tools such as nmap with -sU -p 137 or nbtscan.
2. Confirm WINS service: Send a standard NetBIOS name query to UDP port 137 to confirm the WINS service is active and responding.
3. Craft malicious packet: Construct a malformed WINS RELEASE or MULTI_HOME_REG packet that fails to meet the validation expectations of the Samba WINS handler, triggering a NULL pointer dereference. This can be done using raw socket libraries (e.g., Python's socket module or Scapy).
4. Send crafted UDP packet: Transmit the malformed packet to the target's UDP port 137. No authentication or prior session establishment is required.
5. Observe crash: The WINS service crashes due to the NULL pointer dereference. Repeated sending of the packet prevents the service from recovering, as restart intervals increase with each crash (Samba Advisory, Red Hat Bugzilla).

• Network: Unusual volume of UDP packets to port 137 from unexpected or external source IPs; repeated connection attempts to the WINS service from a single source.
• Logs: Samba log entries showing crashes or segmentation faults in the WINS server process (nmbd); repeated service restart messages in system logs (e.g., /var/log/samba/log.nmbd or systemd journal for nmbd.service).
• Process: Repeated restarts of the nmbd daemon with increasing restart intervals as recorded by the service manager (systemd or init); core dump files generated by nmbd in the Samba working directory.
• File System: Presence of core dump files (e.g., core or nmbd.core) in /var/log/samba/ or the configured core dump directory.

Samba has released patched versions 4.22.10, 4.23.8, and 4.24.3 to address this vulnerability; administrators should upgrade to one of these releases as soon as possible (Samba Advisory). As an immediate workaround for sites that do not require WINS functionality, remove or comment out wins support = yes from the [global] section of smb.conf and restart Samba services. Additionally, network segmentation should be applied to restrict access to UDP port 137 to only authorized internal systems, reducing the attack surface. Distribution-specific patches are available from Ubuntu (USN-8306-1, USN-8306-2), SUSE (SUSE-SU-2026:2076-1, SUSE-SU-2026:2108-1, SUSE-SU-2026:22080-1), openSUSE, Slackware, Fedora, Debian, and Alpine Linux.

The vulnerability was covered by security news outlets including SecurityOnline.info in the context of a broader set of Samba security releases. The Samba team published a formal security advisory crediting the DREAM Security Research Team for discovery. Distribution vendors including Ubuntu, SUSE, openSUSE, Slackware, Fedora, and Debian promptly issued security updates. Community discussion was noted on Mastodon and security mailing lists such as oss-security (oss-sec, SecurityOnline).