Back Linuxsecurity

SUSE Linux Micro 6.2: Critical Samba Patch for CVE-2025

Linuxsecurity •LinuxSecurity Advisories • November 27, 2025

## This update for samba fixes the following issues: Update to 4.22.5: * CVE-2025-10230: Command injection via WINS server hook script (bsc#1251280). * CVE-2025-9640: uninitialized memory disclosure via vfs_streams_xattr (bsc#1251279). * Relax samba-gpupdate requirement for cepces, certmonger, and sscep to a recommends. They are only required if utilizing certificate auto enrollment (bsc#1249087). * Disable timeouts for smb.service so that possibly slow running ExecStartPre script 'update-samba-security-profile' doesn't cause service start to fail due to timeouts (bsc#1249181). * Ensure semanage is pulled in as a requirement when samba in installed when selinux security access mechanism that is used (bsc#1249180). * don't attempt to label paths that don't exist, also remove unecessary Read the Full Advisory

* bsc#1249087 * bsc#1249179 * bsc#1249180 * bsc#1249181 * bsc#1251279 * bsc#1251280 Cross- * CVE-2025-10230 * CVE-2025-9640 CVSS scores: * CVE-2025-10230 ( SUSE ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H * CVE-2025-10230 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H * CVE-2025-9640 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N * CVE-2025-9640 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Products: * SUSE Linux Micro 6.2 An update that solves two vulnerabilities and has four fixes can now be installed. ## * * * Read the Full Advisory

* CVE-2025-10230 ( SUSE ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

* CVE-2025-10230 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

* CVE-2025-9640 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

* CVE-2025-9640 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

* SUSE Linux Micro 6.2

An update that solves two vulnerabilities and has four fixes can now be

Read the Full Advisory

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Samba Vulnerabilities Addressed in SUSE Linux Micro 6.2 Update SUSE Linux Micro 6.2 has released a critical update for Samba addressing two vulnerabilities: CVE-2025-10230, a command injection issue via the WINS server hook script, and CVE-2025-9640, which involves uninitialized memory disclosure. The update also includes changes to the samba-gpupdate requirements and disables timeouts for smb.service. 2 sources 42

Extracted Entities

CVEs (2)

CVE-2025-10230 CVE-2025-9640

Platforms (2)

Samba SUSE Linux Micro 6.2