[Pkg-samba-maint] Bug#1151195: cifs-utils: 2:7.4-1+deb13u1 regression: cifs.upcall ignores cruid, sec=krb5 mounts fail with -ENOKEY

[Michael Tokarev]

On 18.10.2026 08:16, Salvatore Bonaccorso wrote:
> Hi Marc,
> 
> On Sun, Oct 18, 2026 at 06:29:42AM +0200, Marc Strämke wrote:
>> Package: cifs-utils
>> Version: 2:7.4-1+deb13u1
>> Severity: important
>> Tags: regression upstream fixed-upstream patch
>> Control: found -1 2:7.4-1+deb13u1
>> Control: notfound -1 2:7.4-1
>>
>> Dear Maintainer, dear Security Team,
>>
>> the security update 2:7.4-1+deb13u1 (DSA for CVE-2026-12505, uploaded
>> 2026-10-14) breaks Kerberos CIFS mounts that use a credential uid other than
>> the mounting uid ("sec=krb5,cruid=<user>"). This is the usual setup for
>> systemd automounts from /etc/fstab, where the mount is done by root on
>> behalf
>> of a user.
>>
>> The update includes the upstream commit 972c5b5ff95e ("cifs.upcall: remove
>> getpwuid() dependency") but not the follow-up fix for the regression that
>> commit introduced upstream:
>>
>>    [PATCH v2] cifs.upcall: fix regression with krb5 + creduid
>>    Enzo Matsumiya, 2026-07-06, merged by Steve French into smb3-utils
>> for-next
>>    https://ratatoskr.run/linux-cifs/2026/07/17220036/t

This is what happens when the package does not have a real maintainer.
I don't use cifs-utils, I don't really maintain it, - it is just under
the samba-team umbrella, but there's no one in the team besides me.

And to my shame, I did notice this additional fix when thinking about
updating cifs-utils for trixie, after I uploaded 7.8 version to sid.
But there were something else to do at that time, and in the end I
forget about that fix.

> I prepared an update for this fallout, apologies about that. If you
> can test in advance the *unofficial* packages produced by the QA
> testin in
> https://debusine.debian.net/debian/developers/work-request/1474416/
> then please do and report back here.
> 
> Built packages can be found via https://debusine.debian.net/debian/developers/work-request/1474418/#output

Please accept my apologies for that too.

(I can't test the packages now anyway).

Thanks!

/mjt