Public bug reported:
adb server crashes (SIGSEGV or SIGABRT): use-after-free in
BlockingConnectionAdapter::Stop() reading the destroyed transport's serial
Package: adb 1:34.0.5-12build1 (source: android-platform-tools)
Release: Ubuntu 26.10 (stonking), kernel 7.3.0-9-generic, amd64
adb build-id: 5c2ce2f2194f8dbeb4756fba1b891676eef048ec
Summary
-------
The adb server dumps core, sometimes with SIGSEGV and sometimes with
SIGABRT (std::bad_alloc), when wireless-debugging (adb-over-TLS)
transports are repeatedly created and torn down. Both signatures are
the same use-after-free: BlockingConnectionAdapter::Stop() calls
Connection::Serial(), which copies atransport::serial_name() from an
atransport object another thread has already destroyed.
It crashed five times in one afternoon on this machine while a
monitoring script ran `adb connect <host:port>` every 30 seconds
against a phone that was rejecting the TLS handshake (the phone had
dropped this host's key after an OS update). Every rejected handshake
takes the kick-and-destroy teardown path, so that loop rolls the race
repeatedly:
tls_connection.cpp:294 [client]: Post-handshake SSL_peek failed
[SSLV3_ALERT_CERTIFICATE_UNKNOWN]
auth.cpp:500 Handshake failed. Kicking transport
transport.cpp:1160 kicking transport 0x... 10.0.0.36:41413
transport.cpp:407 BlockingConnectionAdapter(10.0.0.36:41413): stopping
transport.cpp:936 destroying transport 10.0.0.36:41413
Steps to reproduce
------------------
1. Pair a host with an Android phone's wireless debugging, then revoke
the trust on the phone (Developer options -> Revoke debugging
authorizations), so every TLS handshake is rejected with
CERTIFICATE_UNKNOWN.
2. Run `adb connect <phone-ip:port>` in a loop (one attempt every
30 seconds suffices).
3. Within an hour or two the adb server dumps core. systemd-coredump
catches it; clients see "protocol fault" or a silent server restart.
Backtraces
----------
Symbolized with debuginfod from the systemd-coredump cores.
SIGSEGV variant (PID 268918, 2026-10-28 18:43 EDT). The string copy
reads length 31523618818 from address 0x45 -- garbage from the freed
object:
#0 __memcpy_avx_unaligned_erms ()
#1 std::char_traits<char>::copy (...)
#2 std::basic_string::_S_copy (__n=31523618818, ...)
#3 std::basic_string::_M_construct<true> (__str=0x45 <error: Cannot access
memory at address 0x45>, __n=31523618817)
#4 std::basic_string::basic_string (...)
#5 atransport::serial_name[abi:cxx11]() const (this=<optimized out>) at
packages/modules/adb/transport.h:344
#6 Connection::Serial[abi:cxx11]() const (this=0x756f440019e0) at
packages/modules/adb/transport.cpp:287
#7 BlockingConnectionAdapter::Stop (this=0x756f440019e0) at
packages/modules/adb/transport.cpp:425
SIGABRT variant (PID 293665, 2026-10-28 19:24 EDT). Same path; this
time the garbage length makes operator new throw std::bad_alloc, which
escapes a noexcept context and calls std::terminate. Note the "source
pointer" 0x2e302e302e303120: read as little-endian ASCII it is
" 10.0.0." -- the destroyed transport's own serial string
("10.0.0.36:41413") lying in the reused allocation:
#5 __gnu_cxx::__verbose_terminate_handler ()
#8 __cxxabiv1::__cxa_throw (tinfo=typeinfo for std::bad_alloc)
#9 operator new (sz=3688786955727418932)
#10 std::__new_allocator<char>::allocate (__n=3688786955727418932)
#13 std::basic_string::_S_allocate (__n=3688786955727418932)
#15 std::basic_string::_M_construct<true> (__str=0x2e302e302e303120 <error:
Cannot access memory at address 0x2e302e302e303120>, __n=3688786955727418931)
(upper frames identical to the SIGSEGV variant: serial_name /
Connection::Serial / BlockingConnectionAdapter::Stop)
An earlier core from 2026-10-03 (PID 287690, SIGABRT) has the same adb
frame offsets, so this is not new to this week's workload.
Expected behavior
-----------------
A rejected TLS handshake should tear the transport down cleanly; the
adb server should not crash.
Additional information
----------------------
Upstream reworked this transport code after the 34.x series (the
current platform-tools release is 37.x), so the likely fixes are
updating the package or backporting the teardown-ordering fix.
Happy to attach the full cores or test a patched build.
Publicly available patch:
https://android-review.googlesource.com/c/platform/packages/modules/adb/+/4396351
ProblemType: Bug
DistroRelease: Ubuntu 26.10
Package: adb 1:34.0.5-12build1
ProcVersionSignature: Ubuntu 7.3.0-9.9-generic 7.3.0-rc6
Uname: Linux 7.3.0-9-generic x86_64
ApportVersion: 2.36.0-0ubuntu1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Wed Oct 28 20:55:34 2026
InstallationDate: Installed on 2025-09-09 (414 days ago)
InstallationMedia: Kubuntu 25.04 "Plucky Puffin" - Release amd64 (20250417)
SourcePackage: android-platform-tools
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: android-platform-tools (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug stonking wayland-session
** Attachment added: "SIGABRT crash dump"
https://bugs.launchpad.net/bugs/2172431/+attachment/6013260/+files/_usr_lib_android-sdk_platform-tools_adb.1000.crash
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172431
Title:
adb server crashes (SIGSEGV or SIGABRT): use-after-free in
BlockingConnectionAdapter::Stop() reading the destroyed transport's
serial
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/android-platform-tools/+bug/2172431/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
