CVE-2025-0620: Samba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session
A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
Other sources
All versions of Samba starting with 4.21.0 are vulnerable to a improper authorization issue. smbd does not pick up group membership changes when re-authenticating an expired SMB session.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sambato a version that resolves this vulnerability.Fixed in 4.21.6Patch CVE-2025-0620
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0620?
CVE-2025-0620 is considered a medium-risk vulnerability due to the potential exposure of file shares.
How do I fix CVE-2025-0620?
To mitigate CVE-2025-0620, it is recommended to update Samba to a version higher than 4.21.0.
What versions of Samba are affected by CVE-2025-0620?
All versions of Samba starting with 4.21.0 are affected by CVE-2025-0620.
What is the impact of CVE-2025-0620 on SMB sessions?
CVE-2025-0620 allows file shares to remain accessible even after group membership changes until clients disconnect and reconnect.
Is there a workaround for CVE-2025-0620 if I cannot upgrade Samba?
A possible workaround for CVE-2025-0620 is to regularly restart the smbd service to force clients to re-authenticate.