The Samba team has announced Samba 4.25, the first stable release in the new 4.25 series for this widely used open-source implementation of the SMB networking protocol, allowing Linux and Unix systems to share files and printers with Windows machines and integrate with Active Directory environments.
The biggest addition is experimental support for SMB3 Persistent Handles, a feature for high-availability environments. It allows clients to reconnect after a server restart or outage while keeping access to files they already had open.
This is especially useful for workloads like virtual machines, databases, and clustered storage, where losing an open file handle can cause serious disruption. Samba notes that the feature adds some performance overhead, so it is intended for specific high-availability use cases rather than general-purpose file servers.
Another notable addition is the new vfs_ceph_rgw module. It allows Ceph Object Gateway buckets to be exposed as SMB shares, giving users access to object storage through a more traditional file-and-folder interface.
Clustered Samba deployments also receive several improvements. Samba 4.25 introduces a new cluster functional level mechanism to make rolling upgrades safer by ensuring cluster-wide changes are enabled only once all nodes support them.
There is also support for cluster-wide rate limiting through the vfs_aio_ratelimit module, helping administrators apply bandwidth limits consistently across nodes instead of handling them independently on each server.
On the security side, Samba now defaults to AES encryption types for Kerberos in domains running at functional level 2008 or newer. The change is tied to CVE-2026-20833 and strengthens the default encryption settings used in those environments.
Finally, Samba 4.25 also includes several CTDB-related improvements, along with configuration cleanup and the removal of the old getwd cache option.
For additional details, see the announcement.
As usual with a major Samba branch, administrators are advised to review the release notes before upgrading, especially if they rely on clustered deployments, Active Directory integration, or high-availability storage setups.
