[Pkg-samba-maint] Bug#1151195: cifs-utils: 2:7.4-1+deb13u1 regression: cifs.upcall ignores cruid, sec=krb5 mounts fail with -ENOKEY

[Marc Strämke]

Package: cifs-utils
Version: 2:7.4-1+deb13u1
Severity: important
Tags: regression upstream fixed-upstream patch
Control: found -1 2:7.4-1+deb13u1
Control: notfound -1 2:7.4-1

Dear Maintainer, dear Security Team,

the security update 2:7.4-1+deb13u1 (DSA for CVE-2026-12505, uploaded
2026-10-14) breaks Kerberos CIFS mounts that use a credential uid other than
the mounting uid ("sec=krb5,cruid=<user>"). This is the usual setup for
systemd automounts from /etc/fstab, where the mount is done by root on 
behalf
of a user.

The update includes the upstream commit 972c5b5ff95e ("cifs.upcall: remove
getpwuid() dependency") but not the follow-up fix for the regression that
commit introduced upstream:

   [PATCH v2] cifs.upcall: fix regression with krb5 + creduid
   Enzo Matsumiya, 2026-07-06, merged by Steve French into smb3-utils 
for-next
   https://ratatoskr.run/linux-cifs/2026/07/17220036/t

Ubuntu ships this fix together with the CVE-2026-12505 update as
debian/patches/CVE-2026-12505-3.patch (e.g. jammy 2:6.14-1ubuntu0.6).


Steps to reproduce
------------------

1. A user (uid 10000 here) has a valid TGT in FILE:/tmp/krb5cc_10000
    (krb5.conf: default_ccache_name = FILE:/tmp/krb5cc_%{uid}).
    root has no ticket.
2. As root, mount:

      mount -t cifs //server.example.com/share /mnt/test \
            -o sec=krb5,cruid=10000,vers=3.1.1

    or through an fstab entry such as

      //server.example.com/share /home/user/share cifs \
  sec=krb5,user=user,cruid=user,uid=user,gid=user,x-systemd.automount 0 0

Expected: cifs.upcall uses the ccache of uid 10000 and the mount succeeds
(as it does with 2:7.4-1).

Actual: the mount fails:

   kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is 
installed
   kernel: CIFS: VFS: \\server.example.com Send error in SessSetup = -126
   kernel: CIFS: VFS: cifs_mount failed w/return code = -126

The cifs.upcall debug output shows that it receives creduid=0x2710 (10000)
correctly from the kernel, but still looks in root's credential cache:

   cifs.upcall: key description: 
cifs.spnego;0;0;39010000;ver=0x2;host=server;
  ip4=192.0.2.10;sec=krb5;uid=0x0;creduid=0x2710;user=root;
                pid=0x2eadc4;upcall_target=mount
   cifs.upcall: upcall_target=mount, not switching namespaces to 
application thread
   cifs.upcall: get_cachename_from_process_env: pid == 0
   cifs.upcall: get_existing_cc: default ccache is FILE:/tmp/krb5cc_0
   cifs.upcall: check_service_ticket_exists: unable to get client 
principal from
                cache: No credentials cache found (filename: /tmp/krb5cc_0)
   cifs.upcall: GSS-API error init_sec_context: No Kerberos credentials 
available
                (default cache: FILE:/tmp/krb5cc_0)
   cifs.upcall: Unable to obtain service ticket
   cifs.upcall: Exit status 458752

The result is the same with upcall_target=app and upcall_target=mount.

Only new SMB sessions are affected. Mounts that reuse an existing SMB 
session to
the same server keep working, so the problem often shows up only later: 
after a
reboot, after an automount idle timeout, or when a new server is 
involved (for
example the target of a DFS referral).


Workaround
----------

Downgrading to the previous version fixes it immediately:

   apt-get install --allow-downgrades cifs-utils=2:7.4-1
   apt-mark hold cifs-utils

With 2:7.4-1 the same upcall logs "default ccache is FILE:/tmp/krb5cc_10000"
and "Exit status 0", and the mount succeeds.


Suggested fix
-------------

Add the upstream patch "cifs.upcall: fix regression with krb5 + creduid"
(see link above; Ubuntu's CVE-2026-12505-3.patch) in a deb13u2 upload.


System information
------------------

Debian GNU/Linux 13 (trixie), amd64
Kernel: 6.12.107+deb13-amd64
cifs-utils: 2:7.4-1+deb13u1 (broken), 2:7.4-1 (works)
keyutils: 1.6.3-6
Samba server side: Samba 4.22 (Debian 13) and Samba 4.13 (Debian 11), AD 
domain