Public bug reported: gnome-shell crashes (use-after-free) when a KMS connector disappears during a hotplug event, e.g. when a USB-C dock (DP-MST) resets its link or monitors are unplugged. The user session is lost and the user is thrown back to GDM.
This is upstream bug https://gitlab.gnome.org/GNOME/mutter/-/work_items/4796 It is fixed upstream by https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/5061 ("kms/connector: Update KMS resource lists in update_connector_in_impl"), merged 2026-05-26 and released in mutter 50.2. Ubuntu 26.04 (resolute) still ships mutter 50.1-0ubuntu2.4 without this fix. Please backport !5061 as an SRU. Package: libmutter-18-0 50.1-0ubuntu2.4, gnome-shell 50.1-0ubuntu1.2 (at crash time) Hardware: Lenovo ThinkBook 16 G6 IRL, Intel Raptor Lake-P Iris Xe (i915), ThinkPad Universal USB-C Dock, two external monitors via DP-MST, Wayland session. Backtrace (symbolized with libmutter-18-0-dbgsym 50.1-0ubuntu2.4): #0 update_modes (gpu_kms=0x5708188f13b0) at ../src/backends/native/meta-gpu-kms.c:249 state = 0xa7a9a7a9a7a9 <- dangling pointer #1 meta_gpu_kms_read_current (gpu=0x5708188f13b0) at ../src/backends/native/meta-gpu-kms.c:382 #2 meta_monitor_manager_real_read_current_state (manager=0x5708188f5850) at ../src/backends/meta-monitor-manager.c:3929 #3 meta_monitor_manager_reload (manager=0x5708188f5850) at ../src/backends/meta-monitor-manager.c:4151 #4 handle_hotplug_event (manager=0x5708188f5850) at ../src/backends/native/meta-monitor-manager-native.c:339 #5 on_kms_resources_changed (...) at ../src/backends/native/meta-monitor-manager-native.c:375 #6 g_closure_invoke () from libgobject-2.0.so.0 ... #15 meta_context_run_main_loop () from libmutter-18.so.0 Kernel messages in the ~3 minutes before the crash (trigger, not the bug itself): i915 0000:00:02.0: [drm] drm_WARN_ON(ret) WARNING: drivers/gpu/drm/i915/display/intel_tc.c:1844 at intel_tc_port_link_reset_work i915 0000:00:02.0: [drm] *ERROR* Failed to get ACT after 3000 ms, last status: 04 gnome-shell: Page flip failed: drmModeAtomicCommit: Invalid argument ucsi_acpi USBC000:00: con1: Firmware bug: duplicate partner altmode SVID 0x17ef kernel: traps: gnome-shell[7244] general protection fault ip:74fec029ad2d ... in libmutter-18.so.0.0.0 The backtrace is identical to the one in upstream issue #4796. [ Impact ] Users with docks / hotplugged monitors lose their whole session (all open apps) when a connector is removed while mutter re-reads KMS state. [ Test Plan ] 1. Connect external monitors via a USB-C/Thunderbolt dock (ideally DP-MST). 2. Repeatedly unplug/replug the dock, or suspend, unplug, resume. 3. Without the fix gnome-shell can crash in update_modes(); with the fix it must not. Also verify normal hotplug (monitors appear/disappear correctly) still works. [ Where problems could occur ] The patch only changes update_connector_in_impl() to call meta_kms_device_update_states_in_impl() instead of meta_kms_impl_device_update_states(), so the MetaKmsDevice resource lists are updated consistently. Regressions would show up as monitors not being detected/updated correctly after hotplug. [ Other Info ] Upstream fix is a 2-line change, alr ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: mutter (not installed) ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 NonfreeKernelModules: zfs ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: pass CurrentDesktop: GNOME Date: Thu Oct 8 09:41:02 2026 InstallationDate: Installed on 2026-03-26 (196 days ago) InstallationMedia: Ubuntu 25.10 "Questing Quokka" - Release amd64 (20251007) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/usr/bin/fish TERM=xterm-256color XDG_RUNTIME_DIR=<set> SourcePackage: mutter UpgradeStatus: Upgraded to resolute on 2026-05-27 (134 days ago) ** Affects: mutter (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute wayland-session -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2169941 Title: gnome-shell crashes with SIGSEGV in update_modes() (meta-gpu- kms.c:249) on monitor hotplug — please backport upstream fix !5061 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2169941/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
