Public bug reported:
## Description
VirtualBox (Manager and VM window) segfaults when the work area of the screen
it is maximized on
changes: undocking a laptop, disabling an external monitor, switching to mirror
mode, or changing
the display scale. If a VM runs in the default GUI frontend, the guest dies
with the process.
This happened on a real USB-C undock after 89 hours of guest uptime.
Reproducible on demand (3/3 runs, within 1–4 triggers).
### Steps to reproduce
1. Plasma Wayland session with two outputs, e.g. DP-2 at 0,0 (scale 1) and
eDP-1 at 1920,0 (scale 1.25).
AT-SPI bus running (the default).
2. Start VirtualBox and maximize the Manager window on eDP-1.
3. Run `kscreen-doctor output.DP-2.disable`, or undock.
4. VirtualBox segfaults. If it doesn't, restore the layout and repeat.
The attached script `vbox-a11y-repro.sh` automates this with `wmctrl`
and `kscreen-doctor`.
### Expected
The window is re-maximized on the new work area.
### Actual
SIGSEGV with this stack (the same in all 7 cores):
#0 QWidget::accessibleName() const <- this == NULL
=> mov 0x8(%rsi),%rcx rsi = 0x0
#1 QAccessibleWidget::text(QAccessible::Text) const
#2 QWidgetPrivate::setWindowTitle_sys(QString const&)
#3 QWidgetPrivate::setWindowTitle_helper(QString const&)
#4 QWidgetPrivate::setWindowModified_helper()
#5 QWidgetPrivate::create()
#6 QWidget::create(unsigned long long, bool, bool)
#7 QWidget::setWindowState(QFlags<Qt::WindowState>)
#8 QWidget::showMaximized()
#9 UIDesktopWidgetWatchdog::sltHandleHostScreenWorkAreaResized(QRect
const&)
(or ::updateHostScreenConfiguration <- ::sltHostScreenRemoved)
VirtualBox calls showMaximized() on the work-area change, and Qt re-creates the
native window. The
title update emits an accessibility event, and QAccessibleWidget dereferences a
NULL widget pointer.
### Accessibility is the trigger
| Run | Environment | Result
|
|----------|------------------------------------------------|----------------------|
| control | default | crashed on
trigger 2 |
| control1 | default | crashed on
trigger 1 |
| control2 | default | crashed on
trigger 4 |
| manual | QT_ACCESSIBILITY=0 (confirmed in core memory) | crashed, same
stack |
| nobridge | AT_SPI_BUS_ADDRESS=unix:path=/nonexistent | survived 15/15
|
QT_ACCESSIBILITY=0 is ignored: Qt 6 enables the AT-SPI bridge whenever the bus
is reachable.
Blocking the bus connection avoids the crash completely.
### Workarounds
- Launch VirtualBox with `AT_SPI_BUS_ADDRESS=unix:path=/nonexistent` (no screen
reader support in VirtualBox).
- Run VMs detached so a GUI crash doesn't kill the guest:
`VBoxManage modifyvm <vm> --default-frontend=separate`
### Environment
- Ubuntu 26.04.1 LTS, kernel 7.0.0-34-generic
- virtualbox / virtualbox-qt 7.2.6-dfsg-4
- qt6-base 6.10.2+dfsg-7
- KDE Plasma 6.6.6 Wayland (kwin-wayland 4:6.6.6); VirtualBox runs via XWayland
24.1.10 (QT_QPA_PLATFORM=xcb)
- at-spi2-core 2.60.4; Plasma exports QT_ACCESSIBILITY=1
- Intel Arrow Lake-P iGPU (i915), laptop panel plus external DP over a USB-C
dock
I have 7 cores (1 from a real undock on 2026-10-01, 6 from reproductions on
2026-10-07) and can
provide more information or test patched packages.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: virtualbox 7.2.6-dfsg-4
ProcVersionSignature: Ubuntu 7.0.0-34.34-generic 7.0.14
Uname: Linux 7.0.0-34-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Wed Oct 7 02:58:50 2026
DkmsLog: Error: command ['sh', '-c', "cat /var/lib/dkms/virtualbox/$(dpkg-query
-f '${source:Upstream-Version}\n' -W 'virtualbox' |cut -f 1 -d
'-')/build/make.log"] failed with exit code 1: cat:
/var/lib/dkms/virtualbox/7.2.6/build/make.log: No such file or directory
InstallationDate: Installed on 2020-05-20 (2330 days ago)
InstallationMedia: Ubuntu 19.10 "Eoan Ermine" - Release amd64 (20191017)
RebootRequiredPkgs: Error: path contained symlinks.
SourcePackage: virtualbox
UpgradeStatus: Upgraded to resolute on 2026-08-20 (48 days ago)
** Affects: qt6-base (Ubuntu)
Importance: Undecided
Status: New
** Affects: virtualbox (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
** Attachment added: "The attached script `vbox-a11y-repro.sh` automates
reproduction with `wmctrl` and `kscreen-doctor"
https://bugs.launchpad.net/bugs/2169785/+attachment/6006644/+files/vbox-a11y-repro.sh
** Also affects: qt6-base (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169785
Title:
VirtualBox crashes in QWidget::accessibleName (NULL this) when screen
work area changes, killing running VMs
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/qt6-base/+bug/2169785/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
