https://bugs.kde.org/show_bug.cgi?id=525102
Bug ID: 525102
Summary: PAM-spawned ksecretd (--pam-login) intermittently
crashes with SIGSEGV in QCA/OpenSSL cipher setup on
encrypted Secret Service operations
Classification: Frameworks and Libraries
Product: frameworks-kwallet
Version First 6.29.0
Reported In:
Platform: Arch Linux
OS: Linux
Status: REPORTED
Severity: crash
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
Target Milestone: ---
## SUMMARY
The ksecretd instance spawned at login via PAM (`/usr/bin/ksecretd --pam-login
8 9`) intermittently crashes with SIGSEGV inside
`EVP_CIPHER_CTX_set_key_length` (libcrypto, reached through
`QCA::Cipher::setup` in the qca-ossl plugin) when a client performs a Secret
Service operation over an encrypted session
(`dh-ietf1024-sha256-aes128-cbc-pkcs7`). The client sees "Remote peer
disconnected", and a retry then reports "The name is not activatable". D-Bus
subsequently activates a replacement ksecretd instance, and the same operation
succeeds against it.
User-visible effect: an application that stores or reads secrets through the
Secret Service (libsecret clients such as secret-tool, Chromium, Matrix/Tauri
clients) fails once, apparently at random, and applications that treat that
failure as "no stored credential" silently fall back to asking the user to sign
in again.
The crash does not reproduce on demand: it happened four times over nine days
(2026-08-20 SIGABRT, 2026-08-21 SIGSEGV, 2026-08-28 SIGSEGV, 2026-08-28
SIGABRT) and I have not been able to trigger it deliberately since — running
the reproduction steps below against a currently healthy PAM instance succeeds.
Three of the four coredumps are from low-PID PAM-spawned instances. I am filing
this with the backtrace because the crash site is specific, and I can supply
the coredumps.
## STEPS TO REPRODUCE
Not reliably reproducible; this is what was running each time it happened:
1. Log in to a Plasma (Wayland) session, so PAM spawns `ksecretd --pam-login`.
2. Have an application store or read a secret over an encrypted Secret Service
session, e.g.
`echo -n "x" | secret-tool store --label=test service test account test`
## OBSERVED RESULT (when it triggers)
- secret-tool prints `secret-tool: Remote peer disconnected`; a retry prints
`secret-tool: The name is not activatable`.
- ksecretd dumps core (SIGSEGV). journal shows drkonqi-coredump-processor
picking it up.
- After D-Bus reactivates ksecretd, the same command succeeds.
## EXPECTED RESULT
No crash; the encrypted-session operation succeeds against the PAM-spawned
instance.
## BACKTRACE (coredumpctl, kwallet 6.29.0)
```
Command Line: /usr/bin/ksecretd --pam-login 8 9
Signal: 11 (SEGV)
#4 0x00007f65fbd6c6d8 in EVP_CIPHER_CTX_set_key_length () from
/usr/lib/libcrypto.so.3
#5 0x00007f65eedb8c55 in ?? () from /usr/lib/qt6/plugins/crypto/libqca-ossl.so
#6 0x00007f65ff534fca in QCA::Cipher::setup(QCA::Direction, QCA::SymmetricKey
const&, QCA::InitializationVector const&) () from /usr/lib/libqca-qt6.so.2
#7 0x00007f65ff535314 in QCA::Cipher::Cipher(QString const&,
QCA::Cipher::Mode, QCA::Cipher::Padding, QCA::Direction, QCA::SymmetricKey
const&, QCA::InitializationVector const&, QString const&) () from
/usr/lib/libqca-qt6.so.2
#8 0x00005566ea01c5df in ?? () (ksecretd + 0x4c5df)
#9 0x00005566ea026bd9 in ?? () (ksecretd + 0x26bd9... frames in ksecretd)
```
(Frames #0–#3 are libc/KCrash signal handling. I can attach the full coredump
or a debuginfod-symbolized backtrace on request.)
## ADDITIONAL INFORMATION
- Opening sessions is fine: both `OpenSession("plain")` and the
`dh-ietf1024-sha256-aes128-cbc-pkcs7` DH handshake succeed against the PAM
instance; the crash happens at the subsequent secret encrypt/decrypt, which
matches the `QCA::Cipher` construction site in the stack.
- Plaintext-session clients (e.g. the Rust `keyring` crate with
`sync-secret-service`, no crypto feature) do NOT trigger the crash — only
encrypted sessions do.
- The default wallet (blowfish `.kwl`, created 2026-06) opens fine in
kwalletd6.
- One earlier crash of the same instance type was SIGABRT rather than SIGSEGV
(2026-08-20).
## SOFTWARE/OS VERSIONS
- Operating System: Arch Linux (rolling)
- KDE Plasma Version: 6.7.4 (plasma-workspace 6.7.4-3)
- KDE Frameworks Version: kwallet 6.29.0
- Qt Version: qca-qt6 2.3.10-8
- OpenSSL: 3.6.4
- Graphics Platform: Wayland
--
You are receiving this mail because:
You are watching all bug changes.
