https://bugs.kde.org/show_bug.cgi?id=527591
bermudi <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |[email protected] --- Comment #15 from bermudi <[email protected]> --- Same regression — with kernel-level evidence of what it does inside the NVIDIA driver Environment: EndeavourOS (Arch), Plasma/kwin 6.8.1-1, Wayland. Hybrid laptop, mirror image of the reporter's setup: Intel UHD 630 (i915) renders and drives the internal eDP panel, NVIDIA GTX 1060 Max-Q (Pascal, proprietary 580.178.04, nvidia_drm.modeset=1) drives the external HDMI display. Kernel 7.2.11-arch1-1, Mesa 26.2.5, Qt 6.12.0. Symptoms identical to this bug and its dupes: flicker/corruption of window contents in every app (Qt and non-Qt), worst on the NVIDIA-connected display; taking a Spectacle screenshot forces a recomposite and repairs the corruption until the next frames. New datapoint: on this system the regression turns a latent NVIDIA driver bug into a constant kernel use-after-free. With kwin 6.8.1 the kernel logs repeatedly: BUG: KFENCE: use-after-free read in nv_dma_release_sgt+0x2c/0x80 [nvidia] KFENCE shows a 400-byte kmalloc-512 object that was allocated by kwin_wayland via nv_drm_gem_prime_import_sg_table <- drm_gem_prime_fd_to_handle (importing a buffer into nvidia-drm), freed by kwin_wayland ~17 ms later through nv_dma_release_sgt, and then read again inside nv_dma_release_sgt+0x2c. The full report is attached. Hit frequency correlates 1:1 with the kwin version on identical kernel/Mesa/Qt: - kwin 6.8.0 (3 h session): 0 hits - kwin 6.8.1, first boot: 2 hits in 28 min; second boot: 6 hits in the first 7 min, first hit 50 s after login - the kernel became tainted [B]=BAD_PAGE two minutes after the third hit - downgraded to kwin 6.8.0 + reboot: 0 hits, corruption gone This is consistent with what !10196 describes: with the sync file never imported into the EGL context, the multigpu swapchain copy is unsynchronized, so the driver releases the buffer's scatter-gather table (and its mapping) while the copy still needs it — leaving stale/garbage contents on screen until a forced recomposite re-imports everything, and tripping the use-after-free in the driver's release path. Workaround in use: kwin 6.8.0-1 held via IgnorePkg until !10196 ships in a release. Possibly relevant on the driver side (I can't verify whether it's the same code path): the same KFENCE symbol has been reported on driver 560.35.03 (https://forums.developer.nvidia.com/t/304219), and NVIDIA's May 2026 security bulletin lists CVE-2026-24187, a Linux display-driver use-after-free, fixed in the R580 branch as of 580.159.03. This system runs 580.178.04 — newer than the fixed version — and still reproduces. -- You are receiving this mail because: You are watching all bug changes.
