A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Wed, 13 Aug 2025 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Samba
Samba samba
CPEs cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
Vendors & Products Samba
Samba samba

Fri, 06 Jun 2025 21:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Moderate


Fri, 06 Jun 2025 14:45:00 +0000

Type Values Removed Values Added
References

Fri, 06 Jun 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Fri, 06 Jun 2025 13:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
Title Samba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-552
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2025-08-13T15:18:24.958Z

Reserved: 2025-01-21T15:54:28.429Z

Link: CVE-2025-0620

cve-icon Vulnrichment

Updated: 2025-06-06T13:11:50.526Z

cve-icon NVD

Status : Analyzed

Published: 2025-06-06T14:15:21.247

Modified: 2025-08-13T15:12:08.490

Link: CVE-2025-0620

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-06-03T00:00:00Z

Links: CVE-2025-0620 - Bugzilla

cve-icon OpenCVE Enrichment

No data.