Dear Maintainer, dear Security Team,

the security update 2:7.4-1+deb13u1 (DSA for CVE-2026-12505, uploaded
2026-10-14) breaks Kerberos CIFS mounts that use a credential uid other than
the mounting uid ("sec=krb5,cruid=<user>"). This is the usual setup for
systemd automounts from /etc/fstab, where the mount is done by root on
behalf
of a user.

The update includes the upstream commit 972c5b5ff95e ("cifs.upcall: remove
getpwuid() dependency") but not the follow-up fix for the regression that
commit introduced upstream:

   [PATCH v2] cifs.upcall: fix regression with krb5 + creduid
   Enzo Matsumiya, 2026-07-06, merged by Steve French into smb3-utils
for-next
   https://ratatoskr.run/linux-cifs/2026/07/17220036/t

Ubuntu ships this fix together with the CVE-2026-12505 update as
debian/patches/CVE-2026-12505-3.patch (e.g. jammy 2:6.14-1ubuntu0.6).


Steps to reproduce
------------------

1. A user (uid 10000 here) has a valid TGT in FILE:/tmp/krb5cc_10000
    (krb5.conf: default_ccache_name = FILE:/tmp/krb5cc_%{uid}).
    root has no ticket.
2. As root, mount:

      mount -t cifs //server.example.com/share /mnt/test \
            -o sec=krb5,cruid=10000,vers=3.1.1

    or through an fstab entry such as

      //server.example.com/share /home/user/share cifs \
  sec=krb5,user=user,cruid=user,uid=user,gid=user,x-systemd.automount 0 0

Expected: cifs.upcall uses the ccache of uid 10000 and the mount succeeds
(as it does with 2:7.4-1).

Actual: the mount fails:

   kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is
installed
   kernel: CIFS: VFS: \\server.example.com Send error in SessSetup = -126
   kernel: CIFS: VFS: cifs_mount failed w/return code = -126

The cifs.upcall debug output shows that it receives creduid=0x2710 (10000)
correctly from the kernel, but still looks in root's credential cache:

   cifs.upcall: key description:
cifs.spnego;0;0;39010000;ver=0x2;host=server;
  ip4=192.0.2.10;sec=krb5;uid=0x0;creduid=0x2710;user=root;
                pid=0x2eadc4;upcall_target=mount
   cifs.upcall: upcall_target=mount, not switching namespaces to
application thread
   cifs.upcall: get_cachename_from_process_env: pid == 0
   cifs.upcall: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0
   cifs.upcall: check_service_ticket_exists: unable to get client
principal from
                cache: No credentials cache found (filename: /tmp/krb5cc_0)
   cifs.upcall: GSS-API error init_sec_context: No Kerberos credentials
available
                (default cache: FILE:/tmp/krb5cc_0)
   cifs.upcall: Unable to obtain service ticket
   cifs.upcall: Exit status 458752

The result is the same with upcall_target=app and upcall_target=mount.

Only new SMB sessions are affected. Mounts that reuse an existing SMB
session to
the same server keep working, so the problem often shows up only later:
after a
reboot, after an automount idle timeout, or when a new server is
involved (for
example the target of a DFS referral).


Workaround
----------

Downgrading to the previous version fixes it immediately:

   apt-get install --allow-downgrades cifs-utils=2:7.4-1
   apt-mark hold cifs-utils

With 2:7.4-1 the same upcall logs "default ccache is FILE:/tmp/krb5cc_10000"
and "Exit status 0", and the mount succeeds.


Suggested fix
-------------

Add the upstream patch "cifs.upcall: fix regression with krb5 + creduid"
(see link above; Ubuntu's CVE-2026-12505-3.patch) in a deb13u2 upload.


System information
------------------

Debian GNU/Linux 13 (trixie), amd64
Kernel: 6.12.107+deb13-amd64
cifs-utils: 2:7.4-1+deb13u1 (broken), 2:7.4-1 (works)
keyutils: 1.6.3-6
Samba server side: Samba 4.22 (Debian 13) and Samba 4.13 (Debian 11), AD
domain

Hi Marc,

I prepared an update for this fallout, apologies about that. If you
can test in advance the *unofficial* packages produced by the QA
testin in
https://debusine.debian.net/debian/developers/work-request/1474416/
then please do and report back here.

Built packages can be found via https://debusine.debian.net/debian/developers/work-request/1474418/#output

Regards,
Salvatore

This is what happens when the package does not have a real maintainer.
I don't use cifs-utils, I don't really maintain it, - it is just under
the samba-team umbrella, but there's no one in the team besides me.

And to my shame, I did notice this additional fix when thinking about
updating cifs-utils for trixie, after I uploaded 7.8 version to sid.
But there were something else to do at that time, and in the end I
forget about that fix.

Please accept my apologies for that too.

(I can't test the packages now anyway).

Thanks!

/mjt

Hi Salvatore,

first: wow that was a fast reaction for a Sunday morning. Thank you so
much.

I have tested the package you proposed and it does indeed fix this issue!

Thanks again and kind regards,

Marc

Hi Marc, hi Michael,

Thanks both.

I wil ltry to release the regression fix this afternoon (european
time, I'm offline starting now for a couple of hours, but already
uploaded so we have all builds done).

Regards,
Salvatore

Hi,

Regression update DSA 6567-2, released, thanks again for reporting the
bug.

Bug here will be closed automtically with the updated version once
SRM's have accepted the update as well for stable.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
cifs-utils, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151195@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated cifs-utils package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 18 Oct 2026 07:10:46 +0200
Source: cifs-utils
Architecture: source
Version: 2:7.4-1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: Debian Samba Maintainers <pkg-samba-maint@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1151195
Changes:
 cifs-utils (2:7.4-1+deb13u2) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * cifs.upcall: fix compiler warning with -Wvla
   * cifs.upcall: fix regression with krb5 + creduid (Closes: #1151195)
Checksums-Sha1:
 6dfcd6257704f8ab2dffe97b254b3a758e46f2ae 2667 cifs-utils_7.4-1+deb13u2.dsc
 dd683ad2b27d18d3a565d4de318bf453ecd7f9e7 17588 cifs-utils_7.4-1+deb13u2.debian.tar.xz
 165f0f474dcb63bad101273120a341cbfc302706 5321 cifs-utils_7.4-1+deb13u2_source.buildinfo
Checksums-Sha256:
 ee3cb95c6cc16eea8649a2d80c6b561d6e1181eef18ba247de3145103c8fabb6 2667 cifs-utils_7.4-1+deb13u2.dsc
 14cf1d73037d4fcaaa883a6f775cb978a6e6dec9d2102f3368db4fa00111b983 17588 cifs-utils_7.4-1+deb13u2.debian.tar.xz
 099646f0b673f196acb3564cf66b467f2dce3c775777fc15fe2808f1ac09b9f7 5321 cifs-utils_7.4-1+deb13u2_source.buildinfo
Files:
 18d94cbe88b5b1249584e63ebdd8eb1a 2667 otherosfs optional cifs-utils_7.4-1+deb13u2.dsc
 245bf3e6f833f3ce7e0dd86ee5713d55 17588 otherosfs optional cifs-utils_7.4-1+deb13u2.debian.tar.xz
 b837837f6670fe53ce258f45c12f6f4c 5321 otherosfs optional cifs-utils_7.4-1+deb13u2_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrUbeVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EAecP/i3JkIlddxyXinGKQJY2Z9w7H9BwxXCR
AxVXYlB1npxH3V1wIEJzKnGYQMz9vUNcnSbnAcdVLRWru0hMJgjyJyNLY/Sb9VKf
pb5eudIuE6BrL4xASehHBlcsMjQqRVMbt9pgj8eSomkV8eeRGlpvD0Be4OmrrCas
0d2hf2n0zVezZwhk/l8+9dNZom9aJxVn9P+v8rXEBESNtYFk6TInvQk0spwY5pSk
FtjQg1b6CTIsCKRR18jIHsqlOXsIPtjQs4HDVtHCdMbC9Fnm4wApZVmnSY94XwVD
ZZau5XDqpLAF/Z/Dg4LjRJveS3Y9LHfTC5kqTA7sCaN2shoO6hCaNDo0iVMBwTWi
WRXl0NVkOv7I9pWaYjwtc72WUjPIMpGirCSt3M6aKA/UtYtLovNdzvP13RlFXe43
3tdS6TypbK+UUvLrwib1ZexH/HKkPsVFEKhkkhKmCyrLo92I+FCq99gvZ8iKNtmd
A6GeVAk08MgKi6sZdOikkkCxh1g4nx/u4gmlU4AdxWc1n26LuUxAwwJzXjdIGa59
DdRmiHdbsWEoGqFyZIKQ7cTWIyNSoYv+i8ESGw57Q092llt0KfNeGyJC3xg2Zh+e
9Ori9uympZ9XZQPYwA1g34dSI/ivsh7Z1XuoRJAabbTdj5pCLadur+NXJPfd+dpx
AhwzNeNbnagP
=sKEu
-----END PGP SIGNATURE-----