Samba 4.25 Ships Experimental SMB3 Persistent Handles, Cluster Functional Levels and a Ceph Object Gateway Module
The first stable Samba 4.25 release adds experimental SMB3 Persistent Handles, a cluster functional level for safer rolling upgrades, and Ceph Object Gateway shares.
Editor's Note ·
- Clarification:
- The article states that Linuxiac says the Kerberos AES default "addresses CVE-2026-20833." Linuxiac says the change is "tied to CVE-2026-20833"; neither cited source says the change fixes or remediates the CVE, and LinuxCompatible notes the CVE advisory's full details were still pending at the time of writing.
Overview
The Samba team has released Samba 4.25, the first stable release in the 4.25 series of the open-source SMB implementation, according to Linuxiac. LinuxCompatible dates the release to September 24, 2026. The release centers on high-availability and clustering features, led by experimental support for SMB3 Persistent Handles.
What We Know
Persistent Handles
The most significant addition, per Linuxiac, is experimental support for SMB3 Persistent Handles, which let clients “reconnect after a server restart or outage while keeping access to files they already had open.” Linuxiac describes the feature as particularly useful for virtual machines, databases and clustered storage, where losing file-handle access could cause substantial disruption.
The feature carries costs. Samba notes that it introduces performance overhead and is intended for specific high-availability scenarios rather than general-purpose file servers, according to Linuxiac. LinuxCompatible adds that it disables POSIX file access and NFS interoperability on the affected shares and introduces measurable latency overhead.
Cluster upgrades and rate limiting
Clustered deployments gain a cluster functional level mechanism intended to make rolling upgrades safer by “ensuring cluster-wide changes are enabled only once all nodes support them,” Linuxiac reports. The release also adds cluster-wide rate limiting through the vfs_aio_ratelimit module, which Linuxiac says lets administrators apply bandwidth limits consistently across nodes. LinuxCompatible names a ratelimitd daemon as the component behind the cluster-wide limiting.
Ceph Object Gateway shares
A new vfs_ceph_rgw module allows Ceph Object Gateway buckets to be presented as SMB shares, giving users a traditional file-and-folder interface to object storage, according to Linuxiac.
Security default and cleanup
Samba now defaults to AES encryption types for Kerberos in domains running at functional level 2008 or newer, which Linuxiac says addresses CVE-2026-20833. The release also includes CTDB-related improvements, configuration cleanup and removal of the legacy getwd cache option, per the same report.
What We Don’t Know
The cited reports do not quantify the performance cost of Persistent Handles, and the feature is labeled experimental, so its readiness for production workloads is untested in the coverage reviewed. Neither report indicates when the feature might be considered stable. LinuxCompatible characterizes 4.25 as a feature-track release aimed at new deployments and early adopters rather than conservative production environments.
Analysis
The combination of persistent handles and a cluster functional level points Samba’s clustered mode toward workloads, such as virtual machine storage and databases, that cannot tolerate dropped file handles. The trade-off Samba itself flags, extra overhead and reduced POSIX and NFS interoperability on affected shares, suggests the feature will suit dedicated shares rather than mixed-protocol file servers.