diff --git a/ChangeLog b/ChangeLog
index 908dcd496..7ec760c64 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,8 @@
 20120426
  - (djm) [auth-passwd.c] Handle crypt() returning NULL; from Paul Wouters
    via Niels
+ - (djm) [auth-krb5.c] Save errno across calls that might modify it;
+   ok dtucker@
 
 20120423
  - OpenBSD CVS Sync
diff --git a/auth-krb5.c b/auth-krb5.c
index d019fe202..922c66c66 100644
--- a/auth-krb5.c
+++ b/auth-krb5.c
@@ -226,7 +226,7 @@ krb5_cleanup_proc(Authctxt *authctxt)
 #ifndef HEIMDAL
 krb5_error_code
 ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
-	int tmpfd, ret;
+	int tmpfd, ret, oerrno;
 	char ccname[40];
 	mode_t old_umask;
 
@@ -237,16 +237,18 @@ ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
 
 	old_umask = umask(0177);
 	tmpfd = mkstemp(ccname + strlen("FILE:"));
+	oerrno = errno;
 	umask(old_umask);
 	if (tmpfd == -1) {
-		logit("mkstemp(): %.100s", strerror(errno));
-		return errno;
+		logit("mkstemp(): %.100s", strerror(oerrno));
+		return oerrno;
 	}
 
 	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
-		logit("fchmod(): %.100s", strerror(errno));
+		oerrno = errno;
+		logit("fchmod(): %.100s", strerror(oerrno));
 		close(tmpfd);
-		return errno;
+		return oerrno;
 	}
 	close(tmpfd);