CVE-2009-2906: Canonical Ubuntu Linux

Medium severity, CVSS 4.0. EPSS: 4.2% chance of exploitation in the next 30 days.

smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 8.10 only; version 9.04 only
• Samba Samba: before 3.0.37 (fixed in 3.0.37); from 3.2.0, before 3.2.15 (fixed in 3.2.15); from 3.3.0, before 3.3.8 (fixed in 3.3.8); version 3.4.0 only; version 3.4.1 only

Published 2009-10-07. Last modified 2026-06-16.