As per upstream advisory:

Samba as an Active Directory Domain Controller is based on Kerberos, which provides name-based authentication.  These names are often then used for authorization.

However Microsoft Windows and Active Direcory is SID-based.  SIDs in Windows, similar to UIDs in Linux/Unix (if managed well) are globally
unique and survive name changes.  At the meeting of these two authorization schemes it is possible to confuse a server into acting as one user when holding a ticket for another.

A Kerberos ticket, once issued, may be valid for some time, often 10 hours but potentially longer.  In Active Directory, it may or may not
carry a PAC, holding the user's SIDs. 

Delegated administrators with the right to create other user or machine accounts can abuse the race between the time of ticket issue and the time of presentation (back to the AD DC) to impersonate a different user.