[From nobody Thu Oct 22 19:49:05 2026 Received: (at submit) by bugs.debian.org; 18 Oct 2026 04:29:49 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-15.1 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU, DKIM_VALID_EF,FOURLA,FREEMAIL_FROM,HAS_PACKAGE,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 98; hammy, 150; neutral, 207; spammy, 0. spammytokens: hammytokens:0.000-+--trixie, 0.000-+--H*r:IPV6, 0.000-+--deb13u1, 0.000-+--deb13amd64, 0.000-+--deb13-amd64 Return-path: <marcstraemke@gmail.com> Received: from mail-wm1-x32a.google.com ([2a00:1450:4864:20::32a]:43514) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim 4.96) (envelope-from <marcstraemke@gmail.com>) id 1xIIWq-0029Pp-1N for submit@bugs.debian.org; Sun, 18 Oct 2026 04:29:49 +0000 Received: by mail-wm1-x32a.google.com with SMTP id 5b1f17b1804b1-49e73611928so12657695e9.1 for <submit@bugs.debian.org>; Sat, 17 Oct 2026 21:29:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792297784; x=1792902584; darn=bugs.debian.org; h=content-transfer-encoding:content-type:subject:from:to :content-language:user-agent:mime-version:date:message-id:from:to:cc :subject:date:message-id:reply-to:content-type; bh=DVony048pr17Sc0e7mhX7iIbP0gnUHQn3s1Axp6zMmw=; b=JgiOujzYxBRjbO1k57zlbLVy74oxzUN5e+cim9Nz6sfRF9pJG8VxtA4A4hbkbWXA/k Z1DfeMmIx2VGzHCldrJQwpwteM2Ani/kWSXXqBwRRuP49c3u6qGMyyc1A9vcS8OTyu4p oJoQwRDTYDuFuP9wxBqJhIYj6g45mfGO8jr6paIwKMokGlAiXPUybj36xyo/ykKFLOEL pRHLdGqZ7H+qKuqn7gP+naWl9U8F2x2lQm1J6pnHTPFupEdTMTr4ZVidYBr8OljiDC9x 0iXKRMCGbHd1qNd8ISoJ8aEDpsC+qM/v9M3c2VMzfmORli2oI1l/KkEKvXFmH1O45mMk K+3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792297784; x=1792902584; h=content-transfer-encoding:content-type:subject:from:to :content-language:user-agent:mime-version:date:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=DVony048pr17Sc0e7mhX7iIbP0gnUHQn3s1Axp6zMmw=; b=JV7BRUh0sbo9Ka7/lbjhRJj62XZUvjt9bbC39UkulHiKF0bBtYGe+cTyDd/s1etwJK 7UyVsYGxsUnKU5PIabiUIB80wVetikQ5MxaB2g2iSFEJCn18/2FuXBgMA8A9V+0RqPlK 9KD0Bh8aDtcrnOlvyq17Dq9pV2OBuNyjVVl/sumbLVHbW5TWVoLq4lT3/Zr7xpbEBc7V lmYH78MNxvABTgV47gWZ/mHHYzmv2Q8VUUrhsmOQmiC8Y15Vp7Msm9oLWCwVAJzAyVXC FVda768lyZ5G+XaJZH2P/b+BKUhEgI4EL0AsfBuHepgVfT9TqUJWg1+O+RZGWzxBTyus iP6A== X-Gm-Message-State: AFq9FYJMJ4235j4Tt3nIKsha380dh6hda/8UKKg42y94Voyw4EljhZ5o nJzx3UHLcH4QH5TNlc56+InVYiLywnf4mNPBOYOrIWErxpA4nMCx9yBJ+zs5WA== X-Gm-Gg: AYBFou26kVelBIA7p60yOQjLcchtKWx8nnRvkSThLOSn+FPC9FqWWjRtstqDT8uSW+5 vsxUw0rTe5ztc6R9CpSOMA3zJbXM4IGrYpHum7V75dBfkf0vyw1hTNGdQpTO3gKizCN74vdPkSh onfl+jM6+Dt8nHeg0R3pZD5UwKRPurK2TSrj+Vkkb4uxEoVq60WxWdrAU6XyzVuqHXsKbz7h2EQ 1nYD+O9rGhbMEYa9t4LSkv375IFQ0YiZ53RSSekX5FHMP1i/fpCJVcX3a8POsyguhoONBGXp2yN H9s9tLD2k1vRq1v655c9RuIgCoeO1R32yxX20kC24eNRjAAVRqX8FrSyKNXoxAUmHwQzOH5+2s9 RK/N14h1V+t9sPKMvUNR7+l+jFEmK4szfRyubs9GdsXCV4IXnWbKYtmHkB3MDthB8dC5KGD0NTC l/ZHq5m+pvObnxInbAnhVfcr7tL/4cFF71gdL6rjO+426QgHfQon/k5fIC788a6xLOllObDzrdh 4a0bsNRsjg6VXpsFwBCcvGzQzd+V4hoTe21YLooLqLl X-Received: by 2002:a05:600c:a102:b0:4a1:bc14:224b with SMTP id 5b1f17b1804b1-4a1c66b37cfmr139563755e9.10.1792297784230; Sat, 17 Oct 2026 21:29:44 -0700 (PDT) Received: from ?IPV6:2a00:6020:a116:b600::ca9? ([2a00:6020:a116:b600::ca9]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48dfd5ad06bsm14992458f8f.14.2026.10.17.21.29.43 for <submit@bugs.debian.org> (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 17 Oct 2026 21:29:43 -0700 (PDT) Message-ID: <df53672e-023c-4822-99d8-3b483cdf1277@gmail.com> Date: Sun, 18 Oct 2026 06:29:42 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: submit@bugs.debian.org From: =?UTF-8?Q?Marc_Str=C3=A4mke?= <marcstraemke@gmail.com> Subject: cifs-utils: 2:7.4-1+deb13u1 regression: cifs.upcall ignores cruid, sec=krb5 mounts fail with -ENOKEY Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Delivered-To: submit@bugs.debian.org Package: cifs-utils Version: 2:7.4-1+deb13u1 Severity: important Tags: regression upstream fixed-upstream patch Control: found -1 2:7.4-1+deb13u1 Control: notfound -1 2:7.4-1 Dear Maintainer, dear Security Team, the security update 2:7.4-1+deb13u1 (DSA for CVE-2026-12505, uploaded 2026-10-14) breaks Kerberos CIFS mounts that use a credential uid other than the mounting uid ("sec=krb5,cruid=<user>"). This is the usual setup for systemd automounts from /etc/fstab, where the mount is done by root on behalf of a user. The update includes the upstream commit 972c5b5ff95e ("cifs.upcall: remove getpwuid() dependency") but not the follow-up fix for the regression that commit introduced upstream:   [PATCH v2] cifs.upcall: fix regression with krb5 + creduid   Enzo Matsumiya, 2026-07-06, merged by Steve French into smb3-utils for-next   https://ratatoskr.run/linux-cifs/2026/07/17220036/t Ubuntu ships this fix together with the CVE-2026-12505 update as debian/patches/CVE-2026-12505-3.patch (e.g. jammy 2:6.14-1ubuntu0.6). Steps to reproduce ------------------ 1. A user (uid 10000 here) has a valid TGT in FILE:/tmp/krb5cc_10000    (krb5.conf: default_ccache_name = FILE:/tmp/krb5cc_%{uid}).    root has no ticket. 2. As root, mount:      mount -t cifs //server.example.com/share /mnt/test \            -o sec=krb5,cruid=10000,vers=3.1.1    or through an fstab entry such as      //server.example.com/share /home/user/share cifs \  sec=krb5,user=user,cruid=user,uid=user,gid=user,x-systemd.automount 0 0 Expected: cifs.upcall uses the ccache of uid 10000 and the mount succeeds (as it does with 2:7.4-1). Actual: the mount fails:   kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed   kernel: CIFS: VFS: \\server.example.com Send error in SessSetup = -126   kernel: CIFS: VFS: cifs_mount failed w/return code = -126 The cifs.upcall debug output shows that it receives creduid=0x2710 (10000) correctly from the kernel, but still looks in root's credential cache:   cifs.upcall: key description: cifs.spnego;0;0;39010000;ver=0x2;host=server;  ip4=192.0.2.10;sec=krb5;uid=0x0;creduid=0x2710;user=root;                pid=0x2eadc4;upcall_target=mount   cifs.upcall: upcall_target=mount, not switching namespaces to application thread   cifs.upcall: get_cachename_from_process_env: pid == 0   cifs.upcall: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0   cifs.upcall: check_service_ticket_exists: unable to get client principal from                cache: No credentials cache found (filename: /tmp/krb5cc_0)   cifs.upcall: GSS-API error init_sec_context: No Kerberos credentials available                (default cache: FILE:/tmp/krb5cc_0)   cifs.upcall: Unable to obtain service ticket   cifs.upcall: Exit status 458752 The result is the same with upcall_target=app and upcall_target=mount. Only new SMB sessions are affected. Mounts that reuse an existing SMB session to the same server keep working, so the problem often shows up only later: after a reboot, after an automount idle timeout, or when a new server is involved (for example the target of a DFS referral). Workaround ---------- Downgrading to the previous version fixes it immediately:   apt-get install --allow-downgrades cifs-utils=2:7.4-1   apt-mark hold cifs-utils With 2:7.4-1 the same upcall logs "default ccache is FILE:/tmp/krb5cc_10000" and "Exit status 0", and the mount succeeds. Suggested fix ------------- Add the upstream patch "cifs.upcall: fix regression with krb5 + creduid" (see link above; Ubuntu's CVE-2026-12505-3.patch) in a deb13u2 upload. System information ------------------ Debian GNU/Linux 13 (trixie), amd64 Kernel: 6.12.107+deb13-amd64 cifs-utils: 2:7.4-1+deb13u1 (broken), 2:7.4-1 (works) keyutils: 1.6.3-6 Samba server side: Samba 4.22 (Debian 13) and Samba 4.13 (Debian 11), AD domain ]