Public bug reported:
Boot 2026-10-11 12:32:18 -> 2026-10-13 11:36:25 (-03), ~47 h uptime,
kernel 7.0.0-38-generic #38~24.04.4-Ubuntu (noble HWE).On 2026-10-13
11:36:22-11:36:25 there were three kernel Oopses in three seconds, no
clean shutdown:the machine had to be powered off by the button.
panic_on_oops=0, so the kernel did not reboot itself(uptime today is
from the manual power-on).Sequence, from the kernel log (times -03):1.
11:36:22 traps: ThreadPoolForeg[2568495] trap invalid opcode ... in
chrome[...] (userspace SIGILL in a Chrome worker, one second
BEFORE the first Oops)2. 11:36:23 BUG: unable to handle page fault for
address: ffffffffaf068350 #PF: supervisor write access in
kernel mode / #PF: error_code(0x0003) - permissions violation
Oops: 0003 [#1] SMP NOPTI CPU: 12 Comm: gnome-shell
RIP: 0010:fput+0x1b/0x90 Call Trace: <TASK>
? fdget+0xd0/0x100 do_poll.constprop.0+0x20b/0x350
do_sys_poll+0x19f/0x280 ? __pfx_pollwake+0x10/0x10 (x9)
__x64_sys_poll+0xc6/0x150 x64_sys_call+0x16a9/0x26e0
note: gnome-shell[1354533] exited with irqs disabled note:
gnome-shell[1354533] exited with preempt_count 13. 11:36:23 Oops:
invalid opcode: 0000 [#2] SMP NOPTI Comm: Xorg RIP:
0010:srso_alias_return_thunk+0x5/0xfbef5 (cascade) note:
Xorg[1354235] exited with irqs disabled / exited with preempt_count 14.
11:36:25 BUG: kernel NULL pointer dereference, address:
0000000000000001 #PF: supervisor instruction fetch in kernel
mode / error_code(0x0010) - not-present page Oops: 0010 [#3]
SMP NOPTI Comm: gdbus RIP: 0010:0x1 note:
gdbus[1354550] exited with irqs disabled / exited with preempt_count
1InterpretationThe kernel died inside fput() reached from the poll(2)
syscall path(do_sys_poll -> do_poll -> fdget -> fput), with the struct
file pointer already corrupted:the faulting address ffffffffaf068350
lies inside the kernel's own text/data mapping (it matches thevalue also
present in the register dump), so this is not a NULL deref of a
userspace value.Three tasks died in kernel context within three seconds
(gnome-shell, Xorg, gdbus) - the whole X11session went down with them,
which is what the user observed. The SIGILL in a Chrome worker onesecond
earlier suggests memory corruption was already in flight before the
first Oops.Not the known amdgpu hang on this machine: that boot contains
zero'ring ... timeout', 'MES failed to respond', 'DMCUB error' or 'flip
queue failed'.(The 76 'REG_WAIT ... dcn31_program_compbuf_size' / 'No FB
bound' lines are normal display-init noise here.)No hardware error
evidence: no 'mce: [Hardware Error]', no 'Machine Check Exception', no
EDAC CE/UE,/sys/fs/pstore/ is empty, and no disk/filesystem errors
before the freeze.The taint is G S U D W; [S]=CPU_OUT_OF_SPEC is set by
the Oops handler itself, not by a CPU fault.Note: this kernel already
contains the fixed eventpoll code shape of
CVE-2026-46242(ep_remove_file.isra.0 is present in /proc/kallsyms), so
this looks like a siblingfile-lifetime/corruption bug on the plain
poll() path, not that epoll CVE.EnvironmentMicro Computer (HK) Tech
Limited Venus series / F7BSC (Minisforum UM790 Pro)AMD Ryzen 9 7940HS,
Radeon 780M (Phoenix), BIOS 1.09 (2023-11-20)Ubuntu 24.04 LTS (noble)
HWE, GNOME on X11, three monitors (1x DisplayPort, 2x HDMI, one
rotated)Kernel cmdline: quiet splash drm.debug=0xe log_buf_len=8M
amdgpu.cwsr_enable=0 amdgpu.gpu_recovery=1
amdgpu.dcdebugmask=0x810 amdgpu.ppfeaturemask=0xfffd7fff amdgpu.runpm=0
amdgpu.sg_display=0 drm_kms_helper.poll=0 vt.handoff=7Impact~47 h of
uptime lost; forced power-off; the system journal was corrupted by the
unclean shutdown andautomatically renamed/replaced by systemd-journald.
No evidence of data loss on disk.Attachments- version.log
(/proc/version_signature + /proc/version)- lspci-vnvn.log
(hardware inventory)- oops-evidencia.txt (the kernel signature lines
from the crashed boot)- journal-fim-do-boot.txt (the last 300 lines of
the boot that froze)Questions1. Is this signature (fput+0x1b reached
from do_sys_poll -> fdget) known for the 7.0 HWE series on noble?2. If a
fix exists, which linux-hwe-7.0 package version carries it? (installed
here: 7.0.0-38.38~24.04.4)Note on severity: the fault is a memory-
corruption/UAF-style failure inside the kernel (fput() acting on an
already-corrupted struct file, followed by a task exiting with IRQs
disabled), so the kernel team may want to assess it as security-relevant
rather than a plain availability bug.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: noble
** Description changed:
- kernel signatures from the crashed boot (sanitised)
+ Boot 2026-10-11 12:32:18 -> 2026-10-13 11:36:25 (-03), ~47 h uptime,
+ kernel 7.0.0-38-generic #38~24.04.4-Ubuntu (noble HWE).On 2026-10-13
+ 11:36:22-11:36:25 there were three kernel Oopses in three seconds, no
+ clean shutdown:the machine had to be powered off by the button.
+ panic_on_oops=0, so the kernel did not reboot itself(uptime today is
+ from the manual power-on).Sequence, from the kernel log (times -03):1.
+ 11:36:22 traps: ThreadPoolForeg[2568495] trap invalid opcode ... in
+ chrome[...] (userspace SIGILL in a Chrome worker, one second
+ BEFORE the first Oops)2. 11:36:23 BUG: unable to handle page fault for
+ address: ffffffffaf068350 #PF: supervisor write access in
+ kernel mode / #PF: error_code(0x0003) - permissions violation
+ Oops: 0003 [#1] SMP NOPTI CPU: 12 Comm: gnome-shell
+ RIP: 0010:fput+0x1b/0x90 Call Trace: <TASK>
+ ? fdget+0xd0/0x100 do_poll.constprop.0+0x20b/0x350
+ do_sys_poll+0x19f/0x280 ? __pfx_pollwake+0x10/0x10 (x9)
+ __x64_sys_poll+0xc6/0x150 x64_sys_call+0x16a9/0x26e0
+ note: gnome-shell[1354533] exited with irqs disabled note:
+ gnome-shell[1354533] exited with preempt_count 13. 11:36:23 Oops:
+ invalid opcode: 0000 [#2] SMP NOPTI Comm: Xorg RIP:
+ 0010:srso_alias_return_thunk+0x5/0xfbef5 (cascade) note:
+ Xorg[1354235] exited with irqs disabled / exited with preempt_count 14.
+ 11:36:25 BUG: kernel NULL pointer dereference, address:
+ 0000000000000001 #PF: supervisor instruction fetch in kernel
+ mode / error_code(0x0010) - not-present page Oops: 0010 [#3]
+ SMP NOPTI Comm: gdbus RIP: 0010:0x1 note:
+ gdbus[1354550] exited with irqs disabled / exited with preempt_count
+ 1InterpretationThe kernel died inside fput() reached from the poll(2)
+ syscall path(do_sys_poll -> do_poll -> fdget -> fput), with the struct
+ file pointer already corrupted:the faulting address ffffffffaf068350
+ lies inside the kernel's own text/data mapping (it matches thevalue also
+ present in the register dump), so this is not a NULL deref of a
+ userspace value.Three tasks died in kernel context within three seconds
+ (gnome-shell, Xorg, gdbus) - the whole X11session went down with them,
+ which is what the user observed. The SIGILL in a Chrome worker onesecond
+ earlier suggests memory corruption was already in flight before the
+ first Oops.Not the known amdgpu hang on this machine: that boot contains
+ zero'ring ... timeout', 'MES failed to respond', 'DMCUB error' or 'flip
+ queue failed'.(The 76 'REG_WAIT ... dcn31_program_compbuf_size' / 'No FB
+ bound' lines are normal display-init noise here.)No hardware error
+ evidence: no 'mce: [Hardware Error]', no 'Machine Check Exception', no
+ EDAC CE/UE,/sys/fs/pstore/ is empty, and no disk/filesystem errors
+ before the freeze.The taint is G S U D W; [S]=CPU_OUT_OF_SPEC is set by
+ the Oops handler itself, not by a CPU fault.Note: this kernel already
+ contains the fixed eventpoll code shape of
+ CVE-2026-46242(ep_remove_file.isra.0 is present in /proc/kallsyms), so
+ this looks like a siblingfile-lifetime/corruption bug on the plain
+ poll() path, not that epoll CVE.EnvironmentMicro Computer (HK) Tech
+ Limited Venus series / F7BSC (Minisforum UM790 Pro)AMD Ryzen 9 7940HS,
+ Radeon 780M (Phoenix), BIOS 1.09 (2023-11-20)Ubuntu 24.04 LTS (noble)
+ HWE, GNOME on X11, three monitors (1x DisplayPort, 2x HDMI, one
+ rotated)Kernel cmdline: quiet splash drm.debug=0xe log_buf_len=8M
+ amdgpu.cwsr_enable=0 amdgpu.gpu_recovery=1
+ amdgpu.dcdebugmask=0x810 amdgpu.ppfeaturemask=0xfffd7fff amdgpu.runpm=0
+ amdgpu.sg_display=0 drm_kms_helper.poll=0 vt.handoff=7Impact~47 h of
+ uptime lost; forced power-off; the system journal was corrupted by the
+ unclean shutdown andautomatically renamed/replaced by systemd-journald.
+ No evidence of data loss on disk.Attachments- version.log
+ (/proc/version_signature + /proc/version)- lspci-vnvn.log
+ (hardware inventory)- oops-evidencia.txt (the kernel signature lines
+ from the crashed boot)- journal-fim-do-boot.txt (the last 300 lines of
+ the boot that froze)Questions1. Is this signature (fput+0x1b reached
+ from do_sys_poll -> fdget) known for the 7.0 HWE series on noble?2. If a
+ fix exists, which linux-hwe-7.0 package version carries it? (installed
+ here: 7.0.0-38.38~24.04.4)Note on severity: the fault is a memory-
+ corruption/UAF-style failure inside the kernel (fput() acting on an
+ already-corrupted struct file, followed by a task exiting with IRQs
+ disabled), so the kernel team may want to assess it as security-relevant
+ rather than a plain availability bug.
** CVE added: https://cve.org/CVERecord?id=CVE-2026-46242
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170730
Title:
7.0.0-38-generic: Oops in fput+0x1b via do_sys_poll (poll syscall)
kills gnome-shell and Xorg - 3 Oopses in 3 s
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2170730/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
