** Description changed:
- Boot 2026-10-11 12:32:18 -> 2026-10-13 11:36:25 (-03), ~47 h uptime,
- kernel 7.0.0-38-generic #38~24.04.4-Ubuntu (noble HWE).On 2026-10-13
- 11:36:22-11:36:25 there were three kernel Oopses in three seconds, no
- clean shutdown:the machine had to be powered off by the button.
- panic_on_oops=0, so the kernel did not reboot itself(uptime today is
- from the manual power-on).Sequence, from the kernel log (times -03):1.
- 11:36:22 traps: ThreadPoolForeg[2568495] trap invalid opcode ... in
- chrome[...] (userspace SIGILL in a Chrome worker, one second
- BEFORE the first Oops)2. 11:36:23 BUG: unable to handle page fault for
- address: ffffffffaf068350 #PF: supervisor write access in
- kernel mode / #PF: error_code(0x0003) - permissions violation
- Oops: 0003 [#1] SMP NOPTI CPU: 12 Comm: gnome-shell
- RIP: 0010:fput+0x1b/0x90 Call Trace: <TASK>
- ? fdget+0xd0/0x100 do_poll.constprop.0+0x20b/0x350
- do_sys_poll+0x19f/0x280 ? __pfx_pollwake+0x10/0x10 (x9)
- __x64_sys_poll+0xc6/0x150 x64_sys_call+0x16a9/0x26e0
- note: gnome-shell[1354533] exited with irqs disabled note:
- gnome-shell[1354533] exited with preempt_count 13. 11:36:23 Oops:
- invalid opcode: 0000 [#2] SMP NOPTI Comm: Xorg RIP:
- 0010:srso_alias_return_thunk+0x5/0xfbef5 (cascade) note:
- Xorg[1354235] exited with irqs disabled / exited with preempt_count 14.
- 11:36:25 BUG: kernel NULL pointer dereference, address:
- 0000000000000001 #PF: supervisor instruction fetch in kernel
- mode / error_code(0x0010) - not-present page Oops: 0010 [#3]
- SMP NOPTI Comm: gdbus RIP: 0010:0x1 note:
- gdbus[1354550] exited with irqs disabled / exited with preempt_count
- 1InterpretationThe kernel died inside fput() reached from the poll(2)
- syscall path(do_sys_poll -> do_poll -> fdget -> fput), with the struct
- file pointer already corrupted:the faulting address ffffffffaf068350
- lies inside the kernel's own text/data mapping (it matches thevalue also
- present in the register dump), so this is not a NULL deref of a
- userspace value.Three tasks died in kernel context within three seconds
- (gnome-shell, Xorg, gdbus) - the whole X11session went down with them,
- which is what the user observed. The SIGILL in a Chrome worker onesecond
- earlier suggests memory corruption was already in flight before the
- first Oops.Not the known amdgpu hang on this machine: that boot contains
- zero'ring ... timeout', 'MES failed to respond', 'DMCUB error' or 'flip
- queue failed'.(The 76 'REG_WAIT ... dcn31_program_compbuf_size' / 'No FB
- bound' lines are normal display-init noise here.)No hardware error
- evidence: no 'mce: [Hardware Error]', no 'Machine Check Exception', no
- EDAC CE/UE,/sys/fs/pstore/ is empty, and no disk/filesystem errors
- before the freeze.The taint is G S U D W; [S]=CPU_OUT_OF_SPEC is set by
- the Oops handler itself, not by a CPU fault.Note: this kernel already
- contains the fixed eventpoll code shape of
- CVE-2026-46242(ep_remove_file.isra.0 is present in /proc/kallsyms), so
- this looks like a siblingfile-lifetime/corruption bug on the plain
- poll() path, not that epoll CVE.EnvironmentMicro Computer (HK) Tech
- Limited Venus series / F7BSC (Minisforum UM790 Pro)AMD Ryzen 9 7940HS,
- Radeon 780M (Phoenix), BIOS 1.09 (2023-11-20)Ubuntu 24.04 LTS (noble)
- HWE, GNOME on X11, three monitors (1x DisplayPort, 2x HDMI, one
- rotated)Kernel cmdline: quiet splash drm.debug=0xe log_buf_len=8M
- amdgpu.cwsr_enable=0 amdgpu.gpu_recovery=1
- amdgpu.dcdebugmask=0x810 amdgpu.ppfeaturemask=0xfffd7fff amdgpu.runpm=0
- amdgpu.sg_display=0 drm_kms_helper.poll=0 vt.handoff=7Impact~47 h of
- uptime lost; forced power-off; the system journal was corrupted by the
- unclean shutdown andautomatically renamed/replaced by systemd-journald.
- No evidence of data loss on disk.Attachments- version.log
- (/proc/version_signature + /proc/version)- lspci-vnvn.log
- (hardware inventory)- oops-evidencia.txt (the kernel signature lines
- from the crashed boot)- journal-fim-do-boot.txt (the last 300 lines of
- the boot that froze)Questions1. Is this signature (fput+0x1b reached
- from do_sys_poll -> fdget) known for the 7.0 HWE series on noble?2. If a
- fix exists, which linux-hwe-7.0 package version carries it? (installed
- here: 7.0.0-38.38~24.04.4)Note on severity: the fault is a memory-
- corruption/UAF-style failure inside the kernel (fput() acting on an
- already-corrupted struct file, followed by a task exiting with IRQs
- disabled), so the kernel team may want to assess it as security-relevant
- rather than a plain availability bug.
+ Boot 2026-10-11 12:32:18 -> 2026-10-13 11:36:25 (-03), ~47 h uptime, kernel
7.0.0-38-generic #38~24.04.4-Ubuntu (noble HWE).
+ On 2026-10-13 11:36:22-11:36:25 there were three kernel Oopses in three
seconds, no clean shutdown: The machine had to be powered off by the button.
panic_on_oops=0, so the kernel did not reboot itself (uptime today is from the
manual power-on). Sequence, from the kernel log (times -03):
+ 1. 11:36:22 traps: ThreadPoolForeg[2568495] trap invalid opcode ... in
chrome[...] (userspace SIGILL in a Chrome worker, one second BEFORE the first
Oops)
+ 2. 11:36:23 BUG: unable to handle page fault for address: ffffffffaf068350
+ #PF: supervisor write access in kernel mode / #PF: error_code(0x0003) -
permissions violation
+ Oops: 0003 [#1] SMP NOPTI CPU: 12 Comm: gnome-shell
+ RIP: 0010:fput+0x1b/0x90 Call Trace: <TASK>
? fdget+0xd0/0x100 do_poll.constprop.0+0x20b/0x350
do_sys_poll+0x19f/0x280 ? __pfx_pollwake+0x10/0x10 (x9)
__x64_sys_poll+0xc6/0x150 x64_sys_call+0x16a9/0x26e0
note: gnome-shell[1354533] exited with irqs disabled note:
gnome-shell[1354533] exited with preempt_count 1
+ 3. 11:36:23 Oops: invalid opcode: 0000 [#2] SMP NOPTI Comm: Xorg
RIP: 0010:srso_alias_return_thunk+0x5/0xfbef5 (cascade)
+ note: Xorg[1354235] exited with irqs disabled / exited with preempt_count 14.
11:36:25 BUG: kernel NULL pointer dereference, address: 0000000000000001
#PF: supervisor instruction fetch in kernel mode / error_code(0x0010) -
not-present page
+ Oops: 0010 [#3] SMP NOPTI Comm: gdbus RIP: 0010:0x1
+ note: gdbus[1354550] exited with irqs disabled / exited with preempt_count 1
+
+ Interpretation
+ The kernel died inside fput() reached from the poll(2) syscall
path(do_sys_poll -> do_poll -> fdget -> fput), with the struct file pointer
already corrupted: The faulting address ffffffffaf068350 lies inside the
kernel's own text/data mapping (it matches the value also present in the
register dump), so this is not a NULL deref of a userspace value. Three tasks
died in kernel context within three seconds (gnome-shell, Xorg, gdbus) - the
whole X11 session went down with them, which is what the user observed.
+
+ The SIGILL in a Chrome worker one second earlier suggests memory corruption
was already in flight before the first Oops. Not the known amdgpu hang on this
machine: that boot contains zero 'ring ... timeout', 'MES failed to respond',
'DMCUB error' or 'flip queue failed'. (The 76 'REG_WAIT ...
dcn31_program_compbuf_size' / 'No FB bound' lines are normal display-init noise
here.)
+ No hardware error evidence: no 'mce: [Hardware Error]', no 'Machine Check
Exception', no EDAC CE/UE,/sys/fs/pstore/ is empty, and no disk/filesystem
errors before the freeze. The taint is G S U D W; [S]=CPU_OUT_OF_SPEC is set by
the Oops handler itself, not by a CPU fault.
+ Note: this kernel already contains the fixed eventpoll code shape of
CVE-2026-46242 (ep_remove_file.isra.0 is present in /proc/kallsyms), so this
looks like a sibling file-lifetime/corruption bug on the plain poll() path, not
that epoll CVE.
+
+ Environment
+ Micro Computer (HK) Tech Limited Venus series / F7BSC (Minisforum UM790 Pro)
+ AMD Ryzen 9 7940HS, Radeon 780M (Phoenix),
+ BIOS 1.09 (2023-11-20)
+ Ubuntu 24.04 LTS (noble) HWE,
+ GNOME on X11,
+ three monitors (1x DisplayPort, 2x HDMI, one rotated)
+ Kernel cmdline: quiet splash drm.debug=0xe log_buf_len=8M
amdgpu.cwsr_enable=0 amdgpu.gpu_recovery=1 amdgpu.dcdebugmask=0x810
amdgpu.ppfeaturemask=0xfffd7fff amdgpu.runpm=0
amdgpu.sg_display=0 drm_kms_helper.poll=0 vt.handoff=7
+
+ Impact
+ ~47 h of uptime lost; forced power-off; the system journal was corrupted by
the unclean shutdown and automatically renamed/replaced by systemd-journald. No
evidence of data loss on disk.
+
+ Attachments
+ version.log (/proc/version_signature + /proc/version)
+ lspci-vnvn.log (hardware inventory)
+ oops-evidencia.txt (the kernel signature lines from the crashed boot)
+ journal-fim-do-boot.txt (the last 300 lines of the boot that froze)
+
+ Questions
+ 1. Is this signature (fput+0x1b reached from do_sys_poll -> fdget) known for
the 7.0 HWE series on noble?
+ 2. If a fix exists, which linux-hwe-7.0 package version carries it?
(installed here: 7.0.0-38.38~24.04.4)
+ Note on severity: the fault is a memory-corruption/UAF-style failure inside
the kernel (fput() acting on an already-corrupted struct file, followed by a
task exiting with IRQs disabled), so the kernel team may want to assess it as
security-relevant rather than a plain availability bug.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170730
Title:
7.0.0-38-generic: Oops in fput+0x1b via do_sys_poll (poll syscall)
kills gnome-shell and Xorg - 3 Oopses in 3 s
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2170730/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
