Samba 4.25.0 arrived on 24 September as the first stable of its series, and one default changed that admins should know about: “kdc default domain supported enctypes” now names the two AES ciphers only, on domains at functional level 2008 or higher. That is the fix for CVE-2026-20833, arriving through the default rather than a config change.
Persistent handles, with the bill
The experimental feature of the series is SMB3 persistent handles: file handles a client can reclaim after a disconnect, a server restart, or both, which is the building block for transparent failover. It is off by default and switched on in two places, globally with “persistent handles = yes” and per share with the “continuous availability” option. The requirements are strict: kernel oplocks, kernel share modes and POSIX locking all have to be off, and that cuts off local POSIX and NFS access to the share. The cost is stated plainly too. Every open, update, lease and close synchronously persists to durable storage, which is why the notes say the feature is for continuous-availability workloads like virtual machine storage, rather than general-purpose file servers.
Clusters, and the durability dial
On a cluster, handle state lives in a volatile ctdb database replicated to every node, with a backup copy in a persistent one. Only the backup survives the whole cluster going down, and maintaining it is expensive: every change costs a cluster-wide transaction written to stable storage on every node. The new “persistent handles durability” option picks a side. full_outage is the default and keeps the backup; partial_outage drops it, survives any outage that leaves at least one node running, and makes every operation noticeably cheaper. Cluster admins also get a cluster functional level, a cluster-wide value raised explicitly through the new net clusterlevel commands. It gates new database formats and internal messages so mixed-version nodes can roll through an upgrade, and a node that cannot match the active level refuses to start.
Smaller things
Cluster-wide rate limiting now enforces share limits as a cluster ceiling instead of per node, through a new daemon, ratelimitd, which needs a build passed –with-ratelimitd. A new vfs_ceph_rgw module exports Ceph Object Gateway buckets as SMB shares, with a folder view over the objects. CTDB’s locks, PID files and sockets moved into ctdb/ subdirectories, infrastructure host monitoring arrives, and the getwd cache is gone. JSON audit entries lost their leading spaces.
My read
The enctype default is the practical change, and it is the quiet kind: it applies where domains are modern enough to take it, and the notes say plainly what it fixes. The persistent handles work is a signpost more than a tool today. It ships off, behind two switches, with the performance price printed in the same section that announces it, which is the honest way to land something that changes filesystem semantics. Read that section before flipping anything on a share people need.
Sources: the Samba 4.25.0 release notes