Public bug reported: PACKAGE / VERSIONS - fontconfig 2.17.1-3ubuntu1 (libfontconfig1), Ubuntu 26.04 LTS (Kubuntu), Plasma 6.6.6 (Wayland), Qt 6.10.2 - Trigger: Google Chrome 154.0.8037.57 and Microsoft Edge 154.0.4258.37 (both Chromium 154, updated 2026-09-25 10:33 via their vendor repos)
SUMMARY After the Chromium 154 update, Chrome/Edge write fontconfig cache files in a newer format (*-le64.cache-12) into the shared ~/.cache/fontconfig/ and create symlinks from the older names (*.cache-9, *.cache-10, *.cache-11) to those files. The system fontconfig (cache format 9) opens <hash>-le64.cache-9, follows the symlink, maps cache-12 data with the cache-9 layout and crashes in FcCharSetHasChar on the first text shaping. Because the call path is QFontEngineMultiFontConfig::shouldLoadFontEngineForCharacter -> FcCharSetHasChar, EVERY Qt application dies on first text rendering: kscreenlocker_greet (the session cannot be unlocked any more, "The screen locker is broken and unlocking is not possible anymore"), sddm- greeter-qt6 (no login possible at all), plasmashell (crash loop), plasma-keyboard, drkonqi-coredump-launcher (the crash handler itself crashes every 25 s), plus Qt-based third-party apps (Insync, OnlyOffice). A browser update thus renders the whole desktop session unusable. On my machine this produced 319 core dumps in one day and left the system without a working login for several hours. STEPS TO REPRODUCE 1. Kubuntu 26.04 with Plasma Wayland, fontconfig 2.17.1. 2. Install Google Chrome 154.0.8037.57 or Microsoft Edge 154.0.4258.37 and start it once. 3. ls -l ~/.cache/fontconfig | grep -- '->' shows e.g. 188ac73a183f12857f63bb60a4a6d603-le64.cache-9 -> 188ac73a183f12857f63bb60a4a6d603-le64.cache-12 (126 such symlinks on my system; list attached) 4. Lock the screen, or start any Qt application. EXPECTED fontconfig ignores or rejects a cache file whose header/version does not match, and continues (rebuilding the cache if necessary). ACTUAL kernel: traps: kscreenlocker_g[64599] general protection fault ip:7c61a05cd4fc ... in libfontconfig.so.1.16.1[c4fc,...] kscreenlocker: Greeter Process encountered an unhandled error: QProcess::Crashed kscreenlocker: Greeter process exit unregular. Restarting lock. (4 times within one second) kscreenlocker: Everything else failed. Need to put Greeter in emergency mode. Backtrace (identical top frames in plasmashell, kscreenlocker_greet, obsidian, claude-desktop, insync): #4 libfontconfig.so.1 + 0xc4fc #5 FcCharSetHasChar (libfontconfig.so.1 + 0xcf79) #6 QFontEngineMultiFontConfig::shouldLoadFontEngineForCharacter (libQt6Gui.so.6) #7 QFontEngineMulti::stringToCMap #8 QTextEngine::shapeText WHAT IS NOT THE CAUSE (checked) - dpkg --verify on fontconfig, freetype, expat and all font packages: clean. - 1116 font files checked individually with fc-query: no failures. Only the cache is affected. - fonts-katex is installed but unaffected here (fc-match sans resolves correctly). - Chromium 152 (Claude Desktop/Electron) and 150 (Obsidian) do NOT create these symlinks; Chromium 154 does, within a second of starting. WORKAROUNDS - rm -rf ~/.cache/fontconfig && fc-cache -r && sudo chattr +i ~/.cache/fontconfig (a plain chmod is undone by the browsers, which reset the permissions) - Start Chromium-based browsers with a private XDG_CACHE_HOME. SUGGESTED FIX fontconfig should validate the cache header (magic, version, size) of the mapped file before dereferencing it, and should not follow a symlink whose target carries a different cache version suffix (or open with O_NOFOLLOW / compare the readlink target). The Chromium side of this behaviour is tracked for Brave in https://github.com/brave/brave-browser/issues/59349 (same mechanism, Chromium 154). The Ubuntu package should be robust against it regardless: a crash in the lock screen and in the display manager greeter is a denial of service of the whole session, triggered by a third-party package update the user cannot influence. ATTACHMENT symlinks-cache-2307.txt: the 126 symlinks found in ~/.cache/fontconfig. A tarball of the poisoned cache directories and an apport crash report of plasmashell are available on request. ** Affects: fontconfig (Ubuntu) Importance: Undecided Status: New ** Attachment added: "126 symlinks cache-9/10/11 -> cache-12 found in ~/.cache/fontconfig after Chromium 154 start" https://bugs.launchpad.net/bugs/2168605/+attachment/6002765/+files/symlinks-cache-2307.txt -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2168605 Title: Segfault in FcCharSetHasChar via cache-9->cache-12 symlinks created by Chromium 154; all Qt apps crash incl. SDDM greeter and kscreenlocker To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/fontconfig/+bug/2168605/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
