Update to version 4.23.5

- resolves: RHEL-143401 - Fix winbind group resolution
- resolves: RHEL-141027 - Fix winbind crash

.gitignore

@@ -311,3 +311,5 @@ samba-3.6.0pre1.tar.gz
 /samba-4.23.3.tar.xz
 /samba-4.23.4.tar.asc
 /samba-4.23.4.tar.xz
+/samba-4.23.5.tar.asc
+/samba-4.23.5.tar.xz

redhat-4.23.patch

@@ -0,0 +1,80 @@
+From e8384b6daea3b8091ad1bcfce84efc9e2c6a746d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
+Date: Thu, 22 Jan 2026 14:27:09 +0100
+Subject: [PATCH] s3:libads: Allocate cli_credentials on a stackframe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This fixes:
+ERROR: talloc_free with references at ../../source3/libads/ldap_utils.c:158
+
+What happens:
+
+* `struct cli_credentials *creds` is allocated on `ads` talloc context
+* gensec_set_credentials() creates a talloc_reference to `creds`
+* TALLOC_FREE(creds) sees two parents and complains
+
+All other code is using temporary talloc_stackframe() for `creds`.
+Do it here as well.
+
+Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
+Reviewed-by: Stefan Metzmacher <metze@samba.org>
+
+Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
+Autobuild-Date(master): Fri Jan 23 11:20:28 UTC 2026 on atb-devel-224
+---
+ source3/libads/ldap_utils.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c
+index 9d6d962a2bc..d01afa69697 100644
+--- a/source3/libads/ldap_utils.c
++++ b/source3/libads/ldap_utils.c
+@@ -99,6 +99,7 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind
+ 		struct cli_credentials *creds = NULL;
+ 		char *cred_name = NULL;
+ 		NTSTATUS ntstatus;
++		TALLOC_CTX *frame = talloc_stackframe();
+ 
+ 		if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) &&
+ 		    ads->config.ldap_page_size >= (lp_ldap_page_size() / 4) &&
+@@ -119,18 +120,20 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind
+ 			DBG_NOTICE("Search for %s in <%s> failed: %s\n",
+ 				   expr, bp, ads_errstr(status));
+ 			SAFE_FREE(bp);
++			TALLOC_FREE(frame);
+ 			return status;
+ 		}
+ 
+ 		ntstatus = ads->auth.reconnect_state->fn(ads,
+ 				ads->auth.reconnect_state->private_data,
+-				ads, &creds);
++				frame, &creds);
+ 		if (!NT_STATUS_IS_OK(ntstatus)) {
+ 			DBG_WARNING("Failed to get creds for realm(%s): %s\n",
+ 				    ads->server.realm, nt_errstr(ntstatus));
+ 			DBG_WARNING("Search for %s in <%s> failed: %s\n",
+ 				   expr, bp, ads_errstr(status));
+ 			SAFE_FREE(bp);
++			TALLOC_FREE(frame);
+ 			return status;
+ 		}
+ 
+@@ -151,11 +154,11 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind
+ 			 * callers depend on it being around.
+ 			 */
+ 			ads_disconnect(ads);
+-			TALLOC_FREE(creds);
++			TALLOC_FREE(frame);
+ 			SAFE_FREE(bp);
+ 			return status;
+ 		}
+-		TALLOC_FREE(creds);
++		TALLOC_FREE(frame);
+ 
+ 		*res = NULL;
+ 
+-- 
+2.52.0
+

samba.spec

@@ -120,7 +120,7 @@
 %bcond lmdb 0
 %endif
 
-%global samba_version 4.23.4
+%global samba_version 4.23.5
 
 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
@@ -230,7 +230,7 @@ Source202:      samba.abignore
 # git format-patch --stdout -l1 --no-renames -N > redhat-4.23.patch
 # where N is number of commits
 
-# Patch0:        redhat-4.23.patch
+Patch0:        redhat-4.23.patch
 
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}

sources

@@ -1,2 +1,2 @@
-SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce
-SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac
+SHA512 (samba-4.23.5.tar.asc) = 5fc1c2e85d1a9242daa7fcc585b5070ca5db8008128e956fb03748d3ef49a696812deec503c26ac9c5509b6ac8e9cc2a698be30ec386f130f9654e1913354ef4
+SHA512 (samba-4.23.5.tar.xz) = a710dcb2b12b9613df446179492b6a69720e0bb9ac52949ac4c25e64348b812a6184a01e007c7acdfee5f43f280d0c4e26aa47b86a37459824a3a84b028ec8a0