Hi Salvatore,
first: wow that was a fast reaction for a Sunday morning. Thank you so
much.
I have tested the package you proposed and it does indeed fix this issue!
Thanks again and kind regards,
Marc
On 10/18/26 07:16, Salvatore Bonaccorso wrote:
Hi Marc,
On Sun, Oct 18, 2026 at 06:29:42AM +0200, Marc Strämke wrote:
Package: cifs-utils
Version: 2:7.4-1+deb13u1
Severity: important
Tags: regression upstream fixed-upstream patch
Control: found -1 2:7.4-1+deb13u1
Control: notfound -1 2:7.4-1
Dear Maintainer, dear Security Team,
the security update 2:7.4-1+deb13u1 (DSA for CVE-2026-12505, uploaded
2026-10-14) breaks Kerberos CIFS mounts that use a credential uid other than
the mounting uid ("sec=krb5,cruid=<user>"). This is the usual setup for
systemd automounts from /etc/fstab, where the mount is done by root on
behalf
of a user.
The update includes the upstream commit 972c5b5ff95e ("cifs.upcall: remove
getpwuid() dependency") but not the follow-up fix for the regression that
commit introduced upstream:
[PATCH v2] cifs.upcall: fix regression with krb5 + creduid
Enzo Matsumiya, 2026-07-06, merged by Steve French into smb3-utils
for-next
https://ratatoskr.run/linux-cifs/2026/07/17220036/t
I prepared an update for this fallout, apologies about that. If you
can test in advance the *unofficial* packages produced by the QA
testin in
https://debusine.debian.net/debian/developers/work-request/1474416/
then please do and report back here.
Built packages can be found via
https://debusine.debian.net/debian/developers/work-request/1474418/#output
Regards,
Salvatore
