Bug 2489808

After this update I can not mount any smb share with smbmount. I have a valid ticket which is shown by klist. I can use it with SSH and also smbclient. Normally I mlount my smb share with autofs which stop working right after this update. To reproduce I used the normal mount command.

mount -t cifs //server.domain.com/share /cifs/ -o sec=krb5,cruid=1000

I get this error:

mount error(126): Required key not available
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)


And this in the logs:

cifs.upcall[41362]: main: valid TGT is not present in credential cache
cifs.upcall[41362]: Unable to obtain service ticket
kernel: CIFS: VFS: \\server.domain.com failed to create a new SMB session with Kerberos: -126
kernel: CIFS: VFS: cifs_mount failed w/return code = -126
kernel: CIFS: Attempting to mount //server.domain.com/sahre
kernel: CIFS: VFS: \\server.domain.com failed to create a new SMB session with Kerberos: -126
kernel: CIFS: VFS: cifs_mount failed w/return code = -126

So the ticket can bot be accessed. I assume that the fix for CVE-2026-12505 is the reason. Is there any configuration update needed?

This is the /etc/krb5.conf file:

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
rnds = false
default_realm = DOMAIN.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
default_ccache_name = KEYRING:persistent:%{uid}

With autofs I use this configuration:

share -fstype=cifs,multiuser,cruid=${UID},sec=krb5,echo_interval=30,vers=3.1.1 ://server.domain.com/share

A downgrade to the previous version restores functionality.

Hi Christian,

Thanks for the detailed report.

Yes, the CVE fix caused a regression with kerberos mounts and I am currently working on a fix for that.

I'll provide a test package with a potential fix soon.

Does the test package [1] work for you?

Thanks.

[1] https://koji.fedoraproject.org/koji/taskinfo?taskID=147203280

Yes. After installing this package kerberos mounts work as before.

Thanks!

I'd just like to add that I also appear to be impacted the same.  I updated cifs-utils yesterday and today noticed I could not connect to shares.

Jun 30 00:45:54 FedoraWS cifs.upcall[103812]: main: valid TGT is not present in credential cache
Jun 30 00:45:54 FedoraWS cifs.upcall[103812]: Unable to obtain service ticket

I downgraded cifs-utils and was successfully able to mount the shares again.

Jun 30 16:35:59 FedoraWS cifs.upcall[233349]: main: valid service ticket exists in credential cache
Jun 30 16:35:59 FedoraWS cifs.upcall[233349]: handle_krb5_mech: getting service ticket for server.com
Jun 30 16:35:59 FedoraWS cifs.upcall[233349]: handle_krb5_mech: using native krb5
Jun 30 16:35:59 FedoraWS cifs.upcall[233349]: handle_krb5_mech: obtained service ticket
Jun 30 16:35:59 FedoraWS cifs.upcall[233349]: Exit status 0

I haven't yet tried the test package, but since it sounds like it provides a fix.  I can follow the update and help confirm the fix.

--CS

FEDORA-2026-90dbff48ca (cifs-utils-7.6-2.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-90dbff48ca

FEDORA-2026-90dbff48ca (cifs-utils-7.6-2.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.

Applied the update from updates-testing for Fedora 44.  I was successfully able to mount the network shares.
--CS

$ sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-3d6c9d67ec

Repositories loaded.
Package                                       Arch        Version                                        Repository                     Size
Upgrading:
 cifs-utils                                   x86_64      0:7.6-2.fc44                                   updates-testing           278.5 KiB
   replacing cifs-utils                       x86_64      0:7.5-1.fc44                                   fedora                    274.4 KiB
 cifs-utils-info                              x86_64      0:7.6-2.fc44                                   updates-testing            41.4 KiB
   replacing cifs-utils-info                  x86_64      0:7.5-1.fc44                                   fedora                     38.2 KiB