A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21475-1 advisory.

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3367-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3362-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3364-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3363-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3365-1 advisory.

    This update for samba fixes the following issues

    - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server (bsc#1271672).
    - CVE-2026-15779: `pam_winbind` module with `mkhomedir` set allows `chown` of critical system paths     without validation       (bsc#1271469).
    - CVE-2026-58216: 6-byte heap OOB read in packet parser of the `kpasswd` service (bsc#1271674).
    - CVE-2026-58218: DNS TKEY negotiation stores unauthenticated GSS contexts in a fixed FIFO before     authentication       completes (bsc#1271675).
    - CVE-2026-58221: authenticated LDAP access to internal LDB special DNs permits domain takeover     (bsc#1271676).
    - CVE-2026-58222: LDAP Compare filter injection and trusted-request confusion disclose protected     attributes       (bsc#1271677).
    - CVE-2026-58224: heap OOB read due to unchecked packet length fields in CTDB (bsc#1271673).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target     account's home directory without validating the path is not a critical system directory such as /. On     affected systems, accounts with / as their home directory (a common default for system accounts) can have     this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands     as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo,     and package-manager failures). The change does not grant write access to / (which ships with restrictive     0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.
    (CVE-2026-15779)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
331556	openSUSE 16: ctdb / ctdb-pcp-pmda / ldb-tools / libldb-devel / libldb2 / etc (openSUSE-SU-2026:21475-1)	Nessus	SuSE Local Security Checks	high
330563	SUSE SLES12: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3367-1)	Nessus	SuSE Local Security Checks	high
330560	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3362-1)	Nessus	SuSE Local Security Checks	high
330553	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3364-1)	Nessus	SuSE Local Security Checks	high
330549	SUSE SLED15: ctdb / ldb-tools / libldb-devel / libldb2 / libldb2-32bit / etc (SUSE-SU-2026:3363-1)	Nessus	SuSE Local Security Checks	high
330538	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3365-1)	Nessus	SuSE Local Security Checks	high
327209	Linux Distros Unpatched Vulnerability : CVE-2026-15779	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-15779

medium

Tenable Plugins

high

high

high

high

high

high

medium