Security updatesSamba Team

Samba 4.25.1 fixes access control in the Ceph RGW module: keep the risk specific to the affected configuration

Samba 4.25.1 includes a fix for CVE-2026-109411. Official guidance says the issue affects only the vfs_ceph_rgw module introduced in 4.25.0. Organisations should check actual usage rather than treating all SMB shares as equally exposed.

Anti-Ransomware · Compiled with SI agent assistanceOfficial version release date:Checked 2026.10.26
Illustration of a female archivist checking data access scope in a digitisation workspace
Illustration · Source ↗ · About this image ↗

Source Facts

Samba released 4.25.1 on 23 October. Its release notes list routine maintenance fixes and an access-control bypass in the vfs_ceph_rgw module. Assigned CVE-2026-109411, the issue concerns case-insensitive file-open handling.

The vendor says the vulnerability affects only the recently released 4.25.0 and its newly added vfs_ceph_rgw module, so it was addressed in the regular bug-fix release. Version 4.25.1 also fixes CTDB, file renaming and other bugs. These changes should not all be classified as the same security issue.

Next Steps for Businesses / Editorial Observations

File-sharing service inventories should record backend modules. A vulnerability in a particular Ceph configuration does not imply equal exposure across every Samba or NAS deployment.

Next steps you can take

  • Check the Samba version and enabled VFS modules to confirm whether vfs_ceph_rgw in 4.25.0 is used.
  • Update to a fixed version through the supplier's supported process, then test sharing permissions, case handling and cluster services.

Original sources

Release Notes for Samba 4.25.1 — October 23, 2026

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxIllustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42Original scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NET