On 18.10.2026 08:16, Salvatore Bonaccorso wrote:
Hi Marc,
On Sun, Oct 18, 2026 at 06:29:42AM +0200, Marc Strämke wrote:
Package: cifs-utils
Version: 2:7.4-1+deb13u1
Severity: important
Tags: regression upstream fixed-upstream patch
Control: found -1 2:7.4-1+deb13u1
Control: notfound -1 2:7.4-1
Dear Maintainer, dear Security Team,
the security update 2:7.4-1+deb13u1 (DSA for CVE-2026-12505, uploaded
2026-10-14) breaks Kerberos CIFS mounts that use a credential uid other than
the mounting uid ("sec=krb5,cruid=<user>"). This is the usual setup for
systemd automounts from /etc/fstab, where the mount is done by root on
behalf
of a user.
The update includes the upstream commit 972c5b5ff95e ("cifs.upcall: remove
getpwuid() dependency") but not the follow-up fix for the regression that
commit introduced upstream:
[PATCH v2] cifs.upcall: fix regression with krb5 + creduid
Enzo Matsumiya, 2026-07-06, merged by Steve French into smb3-utils
for-next
https://ratatoskr.run/linux-cifs/2026/07/17220036/t
This is what happens when the package does not have a real maintainer.
I don't use cifs-utils, I don't really maintain it, - it is just under
the samba-team umbrella, but there's no one in the team besides me.
And to my shame, I did notice this additional fix when thinking about
updating cifs-utils for trixie, after I uploaded 7.8 version to sid.
But there were something else to do at that time, and in the end I
forget about that fix.
I prepared an update for this fallout, apologies about that. If you
can test in advance the *unofficial* packages produced by the QA
testin in
https://debusine.debian.net/debian/developers/work-request/1474416/
then please do and report back here.
Built packages can be found via
https://debusine.debian.net/debian/developers/work-request/1474418/#output
Please accept my apologies for that too.
(I can't test the packages now anyway).
Thanks!
/mjt
