Release Planning for Samba 4.22

Samba 4.22 is in security fixes only mode.

Release blocking bugs

• All 4.22 regression bugs
• Unresolved 4.22 regression bugs

Samba 4.22.11

• 2026-07-28 - Samba 4.22.11 has been released as a Security Release to address the following defects:
  • CVE-2026-6949 (TSIG packet with name compression can crash DNS)
  • CVE-2026-58216 (An authenticated user could possibly crash a KDC process)
  • CVE-2026-58218 (DNS signing DoS via TKEY name cache exhaustion)
  • CVE-2026-58221 (Samba AD authenticated LDAP access domain takeover)
  • CVE-2026-58222 (Samba AD LDAP Compare filter injection and trusted-request Samba AD LDAP Compare filter injection and trusted-request)
  • CVE-2026-58224 (The CTDB protocol has bounds checking issues)

 Release Notes Samba 4.22.11

Samba 4.22.10

• Tuesday, May 26 2026 - Samba 4.22.10 has been released as a Security Release to address the following defects:
  • CVE-2026-1933 (Missing access checks on reparse point operations.)
  • CVE-2026-2340 (WORM vfs module does not block overwrites.)
  • CVE-2026-3012 (auto-enrolment GPO installing CA certificate over http without verification.)
  • CVE-2026-3238 (Denial of service against AD DC WINS server.)
  • CVE-2026-4408 (Unauthenticated Remote Code Execution in Samba DCE/RPC SAMR server.)
  • CVE-2026-4480 (Unauthenticated Remote Code Execution in Samba printing subsystem.)

 Release Notes Samba 4.22.10

Samba 4.22.9

• 2026-04-09 - Samba 4.22.9 has been released.

 Release Notes Samba 4.22.9

Samba 4.22.8

• 2026-02-19 - Samba 4.22.8 has been released.

 Release Notes Samba 4.22.8

Samba 4.22.7

(Updated 18-December-2025)

• Thursday, December 18 2025 - Samba 4.22.7 has been released.

 Release Notes Samba 4.22.7

Samba 4.22.6

(Updated 16-October-2025)

• Thursday, October 16 2025 - Samba 4.22.6 has been released.

 Release Notes Samba 4.22.6

Samba 4.22.5

(Updated 15-October-2025)

• Wednesday, October 15 2025 - Samba 4.22.5 has been released as a Security Release to address the following defect:
  • CVE-2025-10230 (Command injection via WINS server hook script.)
  • CVE-2025-9640 (Uninitialized memory disclosure via vfs_streams_xattr.)

 Release Notes Samba 4.22.5

Samba 4.22.4

(Updated 21-August-2025)

• Thursday, August 21 2025 - Samba 4.22.4 has been released.

 Release Notes Samba 4.22.4

Samba 4.22.3

(Updated 7-July-2025)

• Monday, July 7 2025 - Samba 4.22.3 has been released.

 Release Notes Samba 4.22.3

Samba 4.22.2

(Updated 5-June-2025)

• Thursday, June 5 2025 - Samba 4.22.2 has been released.

 Release Notes Samba 4.22.2

It contains the security-relevant bugfix CVE-2025-0620:

• CVE-2025-0620 (smbd doesn't pick up group membership changes when re-authenticating an expired SMB session.)

Samba 4.22.1

(Updated 17-April-2025)

• Thursday, April 17 2025 - Samba 4.22.1 has been released.

 Release Notes Samba 4.22.1

Samba 4.22.0

(Updated 6-March-2025)

• Thursday, March 6 2025 - Samba 4.22.0 has been released.

 Release Notes Samba 4.22.0

Samba 4.22.0rc4

(Updated 27-February-2025)

• Thursday, February 27 2025 - Samba 4.22.0rc4 has been released.

 Release Notes Samba 4.22.0rc4

Samba 4.22.0rc3

(Updated 20-February-2025)

• Thursday, February 20 2025 - Samba 4.22.0rc3 has been released.

 Release Notes Samba 4.22.0rc3

Samba 4.22.0rc2

(Updated 13-February-2025)

• Thursday, February 13 2025 - Samba 4.22.0rc2 has been released.

 Release Notes Samba 4.22.0rc2

Samba 4.22.0rc1

(Updated 06-February-2025)

• Thursday, February 6 2025 - Samba 4.22.0rc1 has been released.

 Release Notes Samba 4.22.0rc1