The vulnerability exists in pam_winbind's mkhomedir functionality on Red Hat Enterprise Linux 10. When enabled, pam_winbind changes ownership of a user's home directory but fails to verify that the path is not a critical system directory such as /. Accounts with / as their home directory (common for system accounts) can be exploited by non-root users with narrow sudo delegations to run commands as those accounts. This causes the ownership of / to be changed, resulting in denial of service conditions including failures in SSH, sudo, and package management. The root directory remains with restrictive permissions (0555), so the impact is limited to availability loss without further privilege escalation.

The vulnerability leads to availability loss by allowing ownership changes of the root directory (/), disrupting critical system services such as SSH, sudo, and package management. It does not allow privilege escalation or write access to the root directory due to its restrictive permissions. The impact is classified as a severe denial of service on affected systems.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15779 for current remediation guidance. Until an official fix is available, restrict sudo delegations that allow non-root users to run commands as accounts with / as their home directory, and consider disabling mkhomedir in pam_winbind if not required.