Your message dated Thu, 22 Oct 2026 18:47:06 +0000
with message-id <[email protected]>
and subject line Bug#1151195: fixed in cifs-utils 2:7.4-1+deb13u2
has caused the Debian Bug report #1151195,
regarding cifs-utils: 2:7.4-1+deb13u1 regression: cifs.upcall ignores cruid,
sec=krb5 mounts fail with -ENOKEY
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151195: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151195
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: cifs-utils
Version: 2:7.4-1+deb13u1
Severity: important
Tags: regression upstream fixed-upstream patch
Control: found -1 2:7.4-1+deb13u1
Control: notfound -1 2:7.4-1
Dear Maintainer, dear Security Team,
the security update 2:7.4-1+deb13u1 (DSA for CVE-2026-12505, uploaded
2026-10-14) breaks Kerberos CIFS mounts that use a credential uid other than
the mounting uid ("sec=krb5,cruid=<user>"). This is the usual setup for
systemd automounts from /etc/fstab, where the mount is done by root on
behalf
of a user.
The update includes the upstream commit 972c5b5ff95e ("cifs.upcall: remove
getpwuid() dependency") but not the follow-up fix for the regression that
commit introduced upstream:
[PATCH v2] cifs.upcall: fix regression with krb5 + creduid
Enzo Matsumiya, 2026-07-06, merged by Steve French into smb3-utils
for-next
https://ratatoskr.run/linux-cifs/2026/07/17220036/t
Ubuntu ships this fix together with the CVE-2026-12505 update as
debian/patches/CVE-2026-12505-3.patch (e.g. jammy 2:6.14-1ubuntu0.6).
Steps to reproduce
------------------
1. A user (uid 10000 here) has a valid TGT in FILE:/tmp/krb5cc_10000
(krb5.conf: default_ccache_name = FILE:/tmp/krb5cc_%{uid}).
root has no ticket.
2. As root, mount:
mount -t cifs //server.example.com/share /mnt/test \
-o sec=krb5,cruid=10000,vers=3.1.1
or through an fstab entry such as
//server.example.com/share /home/user/share cifs \
sec=krb5,user=user,cruid=user,uid=user,gid=user,x-systemd.automount 0 0
Expected: cifs.upcall uses the ccache of uid 10000 and the mount succeeds
(as it does with 2:7.4-1).
Actual: the mount fails:
kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is
installed
kernel: CIFS: VFS: \\server.example.com Send error in SessSetup = -126
kernel: CIFS: VFS: cifs_mount failed w/return code = -126
The cifs.upcall debug output shows that it receives creduid=0x2710 (10000)
correctly from the kernel, but still looks in root's credential cache:
cifs.upcall: key description:
cifs.spnego;0;0;39010000;ver=0x2;host=server;
ip4=192.0.2.10;sec=krb5;uid=0x0;creduid=0x2710;user=root;
pid=0x2eadc4;upcall_target=mount
cifs.upcall: upcall_target=mount, not switching namespaces to
application thread
cifs.upcall: get_cachename_from_process_env: pid == 0
cifs.upcall: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0
cifs.upcall: check_service_ticket_exists: unable to get client
principal from
cache: No credentials cache found (filename: /tmp/krb5cc_0)
cifs.upcall: GSS-API error init_sec_context: No Kerberos credentials
available
(default cache: FILE:/tmp/krb5cc_0)
cifs.upcall: Unable to obtain service ticket
cifs.upcall: Exit status 458752
The result is the same with upcall_target=app and upcall_target=mount.
Only new SMB sessions are affected. Mounts that reuse an existing SMB
session to
the same server keep working, so the problem often shows up only later:
after a
reboot, after an automount idle timeout, or when a new server is
involved (for
example the target of a DFS referral).
Workaround
----------
Downgrading to the previous version fixes it immediately:
apt-get install --allow-downgrades cifs-utils=2:7.4-1
apt-mark hold cifs-utils
With 2:7.4-1 the same upcall logs "default ccache is FILE:/tmp/krb5cc_10000"
and "Exit status 0", and the mount succeeds.
Suggested fix
-------------
Add the upstream patch "cifs.upcall: fix regression with krb5 + creduid"
(see link above; Ubuntu's CVE-2026-12505-3.patch) in a deb13u2 upload.
System information
------------------
Debian GNU/Linux 13 (trixie), amd64
Kernel: 6.12.107+deb13-amd64
cifs-utils: 2:7.4-1+deb13u1 (broken), 2:7.4-1 (works)
keyutils: 1.6.3-6
Samba server side: Samba 4.22 (Debian 13) and Samba 4.13 (Debian 11), AD
domain
--- End Message ---
--- Begin Message ---
Source: cifs-utils
Source-Version: 2:7.4-1+deb13u2
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
cifs-utils, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated cifs-utils
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 18 Oct 2026 07:10:46 +0200
Source: cifs-utils
Architecture: source
Version: 2:7.4-1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: Debian Samba Maintainers <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1151195
Changes:
cifs-utils (2:7.4-1+deb13u2) trixie-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* cifs.upcall: fix compiler warning with -Wvla
* cifs.upcall: fix regression with krb5 + creduid (Closes: #1151195)
Checksums-Sha1:
6dfcd6257704f8ab2dffe97b254b3a758e46f2ae 2667 cifs-utils_7.4-1+deb13u2.dsc
dd683ad2b27d18d3a565d4de318bf453ecd7f9e7 17588
cifs-utils_7.4-1+deb13u2.debian.tar.xz
165f0f474dcb63bad101273120a341cbfc302706 5321
cifs-utils_7.4-1+deb13u2_source.buildinfo
Checksums-Sha256:
ee3cb95c6cc16eea8649a2d80c6b561d6e1181eef18ba247de3145103c8fabb6 2667
cifs-utils_7.4-1+deb13u2.dsc
14cf1d73037d4fcaaa883a6f775cb978a6e6dec9d2102f3368db4fa00111b983 17588
cifs-utils_7.4-1+deb13u2.debian.tar.xz
099646f0b673f196acb3564cf66b467f2dce3c775777fc15fe2808f1ac09b9f7 5321
cifs-utils_7.4-1+deb13u2_source.buildinfo
Files:
18d94cbe88b5b1249584e63ebdd8eb1a 2667 otherosfs optional
cifs-utils_7.4-1+deb13u2.dsc
245bf3e6f833f3ce7e0dd86ee5713d55 17588 otherosfs optional
cifs-utils_7.4-1+deb13u2.debian.tar.xz
b837837f6670fe53ce258f45c12f6f4c 5321 otherosfs optional
cifs-utils_7.4-1+deb13u2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrUbeVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EAecP/i3JkIlddxyXinGKQJY2Z9w7H9BwxXCR
AxVXYlB1npxH3V1wIEJzKnGYQMz9vUNcnSbnAcdVLRWru0hMJgjyJyNLY/Sb9VKf
pb5eudIuE6BrL4xASehHBlcsMjQqRVMbt9pgj8eSomkV8eeRGlpvD0Be4OmrrCas
0d2hf2n0zVezZwhk/l8+9dNZom9aJxVn9P+v8rXEBESNtYFk6TInvQk0spwY5pSk
FtjQg1b6CTIsCKRR18jIHsqlOXsIPtjQs4HDVtHCdMbC9Fnm4wApZVmnSY94XwVD
ZZau5XDqpLAF/Z/Dg4LjRJveS3Y9LHfTC5kqTA7sCaN2shoO6hCaNDo0iVMBwTWi
WRXl0NVkOv7I9pWaYjwtc72WUjPIMpGirCSt3M6aKA/UtYtLovNdzvP13RlFXe43
3tdS6TypbK+UUvLrwib1ZexH/HKkPsVFEKhkkhKmCyrLo92I+FCq99gvZ8iKNtmd
A6GeVAk08MgKi6sZdOikkkCxh1g4nx/u4gmlU4AdxWc1n26LuUxAwwJzXjdIGa59
DdRmiHdbsWEoGqFyZIKQ7cTWIyNSoYv+i8ESGw57Q092llt0KfNeGyJC3xg2Zh+e
9Ori9uympZ9XZQPYwA1g34dSI/ivsh7Z1XuoRJAabbTdj5pCLadur+NXJPfd+dpx
AhwzNeNbnagP
=sKEu
-----END PGP SIGNATURE-----
pgpuUx_D6zPmx.pgp
Description: PGP signature
--- End Message ---
