Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -g -O0 -std=gnu17
uname output: Linux hostname 6.18.59-1-lts #1 SMP PREEMPT_DYNAMIC Mon,
26 Oct 2026 18:35:24 +0000 x86_64 GNU/Linux
Machine Type: x86_64-pc-linux-gnu
Bash Version: 5.3
Patch Level: 20
Release Status: release
Description:
When hitting a specific key sequence (^S ^R ^C [then any key except ^C])
bash crashes (segfaults).
The bug is likely present in the readline library, and it probably stems
from trying to display the 'reverse-search' prompt while the terminal is
in XOFF flow control (by pressing ^S).
This is a potentially easy to trigger by accident usability issue: a user
reaching for reverse search (^R) may accidentally hit ^S first, which
suspends terminal output (XOFF), so the search prompt never appears.
Pressing ^C to cancel then leaves bash/readline in a state where the next
keypress crashes it. If bash is the top-level shell in a terminal window,
the window closes, losing scrollback and session history.
The issue appeared with the release of bash 5.3 (confirmed with git bisect):
~/bash $ git bisect bad
b8c60bc9ca365f8261fa97900b6fa939f6ebc303 is the first 'bad' commit
commit b8c60bc9ca365f8261fa97900b6fa939f6ebc303 (HEAD, tag: bash-5.3)
Author: Chet Ramey <[email protected]>
Date: Thu Jul 3 16:15:36 2025 -0400
Bash-5.3 distribution sources and documentation
Backtrace:
#0 0x00007fd136c3e8fb in kill () from /usr/lib/libc.so.6
#1 0x0000560390a0778e in kill_shell (sig=11) at sig.c:664
#2 0x0000560390a0773c in termsig_handler (sig=11) at sig.c:646
#3 0x0000560390a0757f in termsig_sighandler (sig=11) at sig.c:570
#4 <signal handler called>
#5 0x0000560390a802cd in _rl_isearch_dispatch
(cxt=0x5603cb0fd410, c=107) at isearch.c:381
#6 0x0000560390a819ad in rl_search_history (direction=-1,
invoking_key=18) at isearch.c:929
#7 0x0000560390a7fbd4 in rl_reverse_search_history (sign=1,
key=18) at isearch.c:135
#8 0x0000560390a6c1d2 in _rl_dispatch_subseq (key=18,
map=0x560390ae35e0 <emacs_standard_keymap>, got_subseq=0) at
readline.c:941
#9 0x0000560390a6bf16 in _rl_dispatch (key=-808462721,
map=0x560390ae35e0 <emacs_standard_keymap>) at readline.c:876
#10 0x0000560390a6b96c in readline_internal_char () at readline.c:690
#11 0x0000560390a6bbf3 in readline_internal_charloop () at readline.c:737
#12 0x0000560390a6bc13 in readline_internal () at readline.c:749
#13 0x0000560390a6b069 in readline (prompt=0x5603cb0f2070
"bash-5.3$ ") at readline.c:387
#14 0x000056039099f105 in yy_readline_get () at
/usr/local/src/chet/src/bash/src/parse.y:1680
#15 0x000056039099f21d in yy_readline_get () at
/usr/local/src/chet/src/bash/src/parse.y:1710
#16 0x000056039099f035 in yy_getc () at
/usr/local/src/chet/src/bash/src/parse.y:1610
#17 0x00005603909a0258 in shell_getc (remove_quoted_newline=1) at
/usr/local/src/chet/src/bash/src/parse.y:2551
#18 0x00005603909a21fe in read_token (command=0) at
/usr/local/src/chet/src/bash/src/parse.y:3612
#19 0x00005603909a151b in yylex () at
/usr/local/src/chet/src/bash/src/parse.y:3078
#20 0x0000560390999fe7 in yyparse () at y.tab.c:1912
#21 0x0000560390999a67 in parse_command () at eval.c:369
#22 0x0000560390999b5c in read_command () at eval.c:414
#23 0x0000560390999417 in reader_loop () at eval.c:147
#24 0x0000560390996ba1 in main (argc=3, argv=0x7ffe9a2af5a8,
env=0x7ffe9a2af5c8) at shell.c:834
Repeat-By:
Prerequisite: Have XON/XOFF flow control enabled (`stty ixon`), which is
the default on many systems/distributions. Also instructions are for the
default setup (you can run bash with `INPUTRC=/dev/null` and
`--norc --noprofile` options.) This also assumes default emacs mode
(`set -o emacs`).
1. Start bash and be in an empty command prompt
2. Press in succession '^S' '^R' '^C' (that is, hold Ctrl and type out
's', 'r' and 'c')
3. Press any other key, other than '^C'. When pressed, bash will crash.
Pressing '^C' in this state will bring you back to prompt.
