[Pkg-samba-maint] Bug#1151195: cifs-utils: 2:7.4-1+deb13u1 regression: cifs.upcall ignores cruid, sec=krb5 mounts fail with -ENOKEY

[Salvatore Bonaccorso]

Hi Marc,

On Sun, Oct 18, 2026 at 06:29:42AM +0200, Marc Strämke wrote:
> Package: cifs-utils
> Version: 2:7.4-1+deb13u1
> Severity: important
> Tags: regression upstream fixed-upstream patch
> Control: found -1 2:7.4-1+deb13u1
> Control: notfound -1 2:7.4-1
> 
> Dear Maintainer, dear Security Team,
> 
> the security update 2:7.4-1+deb13u1 (DSA for CVE-2026-12505, uploaded
> 2026-10-14) breaks Kerberos CIFS mounts that use a credential uid other than
> the mounting uid ("sec=krb5,cruid=<user>"). This is the usual setup for
> systemd automounts from /etc/fstab, where the mount is done by root on
> behalf
> of a user.
> 
> The update includes the upstream commit 972c5b5ff95e ("cifs.upcall: remove
> getpwuid() dependency") but not the follow-up fix for the regression that
> commit introduced upstream:
> 
>   [PATCH v2] cifs.upcall: fix regression with krb5 + creduid
>   Enzo Matsumiya, 2026-07-06, merged by Steve French into smb3-utils
> for-next
>   https://ratatoskr.run/linux-cifs/2026/07/17220036/t

I prepared an update for this fallout, apologies about that. If you
can test in advance the *unofficial* packages produced by the QA
testin in
https://debusine.debian.net/debian/developers/work-request/1474416/
then please do and report back here.

Built packages can be found via https://debusine.debian.net/debian/developers/work-request/1474418/#output 

Regards,
Salvatore