Samba pam_winbind: mkhomedir chowns / when an account's home is the root directory, bricking the node

Impact

With mkhomedir enabled, pam_winbind chowns the target account's home directory without checking that the path is not a critical system directory. Accounts whose home is / - a common default for system accounts - cause ownership of the root directory to change. Red Hat's description is explicit that this is availability loss, not escalation: / ships 0555 on RHEL so no write access is gained, but SSH, sudo and the package manager start failing afterwards. The trigger is not limited to root; a non-root user holding a narrow sudo delegation to run commands as that account is enough. On a GPU node joined to AD through winbind the result is a host that still runs jobs but can no longer be logged into or managed, which means an unplanned drain and a rebuild or manual repair of root ownership.

Who can reach it

A local user holding a sudo delegation to run commands as an account whose winbind home directory is /, on a host with pam_winbind mkhomedir enabled. Also triggerable by root.

What to do

No fixed version is named in the record - Red Hat links the current pam_winbind source rather than a released fix, so track the Samba advisory for the patched release. In the meantime, mitigate: ensure no winbind-resolved account has / (or another system directory) as its home, or disable the mkhomedir option in the pam_winbind stack. Both are config changes that take effect on the next login, with no reboot. A host already affected needs root ownership of / restored by hand, which in practice means taking it out of service.

References

Related entries

• Linux kernel (drivers/vfio/cdx): A tenant can call the interrupt-configuration ioctl with the trigger flags before MSICVE-2026-46034 · Linux kernel (drivers/vfio/cdx)Medium
• OpenSSH client X11 forwarding: a local user can pre-bind the X socket and hijack a forwarded sessionCVE-2026-55655 · OpenSSH client X11 forwarding (abstract UNIX X socket pre-binding)Medium
• Intel VT-d interrupt remapping engine as used by Xen 3.3.x-4.3.x: Proof that interrupt remapping is not a completeCVE-2013-3495 · Intel VT-d interrupt remapping engine as used by Xen 3.3.x-4.3.xMedium
• Xen 3.3.x-4.5.x and Linux kernel through 3.19.1 - PCI command register access for assigned devices: A tenant clears theCVE-2015-2150 · Xen 3.3.x-4.5.x and Linux kernel through 3.19.1 - PCI command register access for assigned devicesMedium
• Intel CPU (AEPIC Leak): Stale data read from the legacy xAPIC MMIO page - leaks SGX enclave and cross-domain dataCVE-2022-21233 · Intel CPU (AEPIC Leak)Medium
• Linux kernel (arch/x86/kvm/vmx): The return stack buffer was not refilled on VM exit when the host used IBRS/eIBRS asCVE-2022-49611 · Linux kernel (arch/x86/kvm/vmx)Medium