Samba: supported versions and security updates

Updated November 2026

Samba lets Linux and Unix servers share files and printers with Windows clients over SMB, and can act as an Active Directory domain controller. As of November 2026 the Samba Team maintains the 4.25, 4.24 and 4.23 series. Install your distribution’s Samba updates, test the configuration with testparm, and restart the Samba services.

Who uses Samba

Samba runs on office file servers, as the SMB part of many NAS appliances, and as the domain controller in networks that use Samba instead of Windows Server for Active Directory. It is a large network-facing service that usually runs as root, and many of its flaws are reachable over port 445. On a NAS appliance you don’t patch Samba yourself; you install the vendor’s firmware or system update (see Synology or TrueNAS).

Check the installed version

smbd --version
samba --version          # Active Directory domain controllers
testparm -s 2>/dev/null | grep -i 'server role'

testparm also shows which role the server has (standalone, member server or domain controller), which tells you which services you need to restart later. Package versions:

# Debian/Ubuntu
dpkg -l | grep -E 'samba|smbclient|winbind'

# RHEL family, Fedora, SUSE
rpm -qa | grep -E 'samba|smbclient|wbclient'

# FreeBSD
pkg info | grep '^samba'

Supported versions

The Samba Team releases a new series about every six months. Each series is fully supported for about six months, then spends six months in maintenance mode, then six months receiving security fixes only: “each series is maintained for a period of approximately 18 months.” After that it is discontinued and gets no more releases.

Samba release series, as of November 2026
Series	Status	Latest release	Security fixes only from	End of life
4.25	Current stable	4.25.1 (Oct 23, 2026)	September 2027	March 2028
4.24	Maintenance	4.24.8 (Oct 12, 2026)	March 2027	September 2027
4.23	Security fixes only	4.23.13 (Oct 1, 2026)	September 2026	March 2027
4.22 and older	Discontinued	–	–	September 2026 (4.22)

Future dates are the Samba Team’s forecasts and can move.

Each Samba series gets about 18 months of fixes. A series that is only in “security fixes only” mode, like 4.23 now, has a few months left.

Distribution packages vs upstream

The Samba Team publishes source releases and patches, not binary packages, so most servers get Samba from their distribution. Distributions backport security fixes into the series they shipped, which means an upstream end-of-life series can still be patched on your system. For example, as of November 2026 Debian 12 ships Samba 4.17 and Debian 13 ships 4.22, both upstream-discontinued series that Debian still patches; Debian 13 users can also get 4.24 from trixie-backports. Backports there means a newer version rebuilt for the stable release. It moves you to a newer series, so test it first, especially on domain controllers.

If you build Samba from source, you are your own distributor: you have to follow every security release and rebuild within your series, and move to a new series before yours is discontinued.

Update commands

Debian and Ubuntu (packages that aren’t installed are skipped):

sudo apt update
sudo apt install --only-upgrade samba samba-common-bin samba-libs smbclient winbind

RHEL, Rocky, AlmaLinux, Fedora:

sudo dnf upgrade --refresh 'samba*' libsmbclient libwbclient

SUSE:

sudo zypper refresh
sudo zypper update samba samba-client

Alpine (as root):

apk -U upgrade

FreeBSD (as root; the package name includes the series, for example samba423):

pkg update
pkg upgrade samba423

On FreeBSD, moving to a newer series means installing a different package (for example a newer sambaNNN port), not a plain upgrade. Check FreshPorts for the series your branch offers.

Test, then restart

Check the configuration before restarting; testparm reports syntax errors and unknown parameters:

testparm -s > /dev/null
sudo smbstatus --brief

smbstatus shows who is connected. Restarting Samba disconnects those clients and can interrupt open files, so warn users or pick a quiet time. Each client connection has its own smbd process, and only new processes run the new code, so restart the services after an update:

# Debian/Ubuntu, file server or member server
sudo systemctl restart smbd nmbd winbind

# Debian/Ubuntu, Active Directory domain controller
sudo systemctl restart samba-ad-dc

# RHEL family, Fedora, SUSE
sudo systemctl restart smb nmb winbind

# Alpine
rc-service samba restart

# FreeBSD
service samba_server restart

Restart only the units that exist on your system (systemctl list-units 'smb*' 'nmb*' 'winbind*' 'samba*'). For a configuration change alone, sudo smbcontrol all reload-config makes running daemons reread smb.conf without disconnecting anyone, but it does not load new binaries. More on this in what to restart after an update.

Verify

smbd --version
sudo smbstatus --brief
smbclient -L localhost -N

The version should match the fixed package, clients should reconnect, and the share list should appear (it may ask for a password if anonymous listing is disabled, which is fine).

Where Samba publishes advisories

Security releases: samba.org/samba/history/security.html lists every security release with its CVEs. Each CVE has its own page under samba.org/samba/security/ with the affected versions, the fix and any workaround.
Mailing list: samba-announce, a “low volume list for Samba announcements”, carries release announcements.
Your distribution: Debian DSA, Ubuntu USN, Red Hat RHSA and SUSE notices tell you which package version contains the fix. See following security advisories.

2026 has been busy: security releases in May and July each fixed six CVEs. One of the May fixes, CVE-2026-4480, is a command injection through the print command setting that Samba scores CVSS 10.0, fixed in 4.22.10, 4.23.8 and 4.24.3. Details and per-distribution fixed packages are on our page for CVE-2026-4480. Current issues are listed on our vulnerabilities page.

Hardening tips

Never expose ports 445 and 139 to the internet; they are a favorite entry point for ransomware. Allow them only from your internal networks or a VPN; see firewall basics.
Limit Samba to internal interfaces with interfaces = … and bind interfaces only = yes, and to known clients with hosts allow (by default all hosts are allowed).
Keep SMB1 off. The default server min protocol is SMB2_02; don’t lower it to NT1 for old clients.
Turn off printing if you don’t share printers: load printers = no, disable spoolss = yes, and remove the [printers] share. If you do print, follow the Samba advice to put single quotes directly around %J in print command ('%J'), or remove %J.
Avoid guest shares, and set restrict anonymous = 2 to block anonymous connections to IPC$ where your clients allow it.
For sensitive shares, require encryption with server smb encrypt = required (the default only offers it).
After every change, run testparm and keep a copy of the previous smb.conf.