Public bug reported: A local shortcut-availability query crashed the entire Plasma Wayland desktop on Ubuntu 26.04.1 LTS. The receiving `kwin_wayland` process aborted while decoding a one-element integer array as a `QKeySequence`. The event matches KDE bug 524700, which is fixed upstream, but the installed/published Resolute package is still `libkf6globalaccel6 6.24.0-0ubuntu1` and contains the affected decoder.
Please assess backporting upstream commit `262cc713ac6444498509170749eb4c5ce2f6c7ae` to Ubuntu's `kf6-kglobalaccel` package. The change checks whether the input array has ended before reading each key. ## Impact On this Plasma Wayland session, `org.kde.kglobalaccel` is hosted in KWin. A session-bus request with an undersized key array can therefore terminate the compositor, disconnect applications and lose unsaved work, even when the requested operation is only a shortcut-availability check. In this incident KWin and Plasma automatically restarted, and Zen subsequently segfaulted. The operating system did not reboot. No elevated privilege is required for the triggering session-bus request. This report concerns a local desktop crash; it does not claim remote exploitability. ## Observed input and reproduction information **WARNING: DO NOT test this on a live desktop containing unsaved work.** No additional reproduction was attempted during diagnosis. This report is based on one already-recorded incident and offline analysis of its preserved core dump. Any maintainer reproduction should use a disposable or isolated test session. The automated local query used this message: ```text Bus: session Service: org.kde.kglobalaccel Path: /kglobalaccel Interface: org.kde.KGlobalAccel Method: globalShortcutAvailable Signature: (ai)s Arguments: ([234881104],) '' ``` The first argument contains **one integer, not four**. The value `234881104` represents Ctrl+Alt+Shift+P in Qt's combined-key encoding. This is message data, not an instruction to press that combination. The type signature allows an array, but the installed decoder assumes four integers without checking the array length. ## Observed result On 2026-10-31 at 00:57:25.072429 UTC, KWin logged: ```text dbus[5312]: type invalid 0 not a basic type ``` Apport recorded `/usr/bin/kwin_wayland` terminating with `SIGABRT` (signal 6). The pending message recovered from the core has exactly the interface, method and signature above. The decoder's first parsed integer is `234881104`, agreeing with the originating local command recorded 29 ms before the abort. The symbolized crashing stack passes through: ```text _dbus_marshal_read_basic.constprop.0 QDBusArgument::operator>>(int&) const operator>>(QDBusArgument const&, QKeySequence&) QDBusMetaType::demarshall QDBusConnectionPrivate::deliverCall ``` The GlobalAccel frame resolves to `src/kglobalshortcutinfo_dbus.cpp:30` in `kf6-kglobalaccel-6.24.0-0ubuntu1`. Offline disassembly of the installed library also shows four unconditional integer reads. `dpkg -V` reported no verification differences for `libkf6globalaccel6`, `libqt6dbus6`, or `kwin-wayland`. The first replacement compositor selected its backend at 00:57:31 UTC. An AMD display timeout also appeared during recovery, after the initial SIGABRT; no GPU function appears in the crashing thread's stack. Today's checked kernel journal contained no panic, OOM-kill, NVIDIA Xid, or GPU-reset indication. Historical accounting recorded about 5.4 GiB available RAM seven minutes before the incident. The current boot continued uninterrupted from 2026-10-25. ## Expected result Reject an undersized key-sequence argument with a D-Bus error, or safely decode it as the upstream fix does. An unexpected argument must not abort KWin or destroy the Wayland desktop. ## Environment ```text Ubuntu 26.04.1 LTS (Resolute), amd64 Session: KDE Plasma on Wayland Kernel: 7.0.0-38-generic kwin-wayland: 4:6.6.6-0ubuntu0.1 plasma-workspace: 4:6.6.6-0ubuntu0.1 libkf6globalaccel6: 6.24.0-0ubuntu1 libqt6dbus6: 6.10.2+dfsg-7 libdbus-1-3: 1.16.2-2ubuntu4 Mesa: 26.0.8-1ubuntu0.3 Graphics: AMD Phoenix1 integrated GPU + NVIDIA RTX 4060 Laptop GPU NVIDIA driver: 595.99.02-0ubuntu0.26.04.1 (open kernel modules) ``` Ubuntu's live primary-archive publication API was checked on 2026-10-31 and returned `6.24.0-0ubuntu1` as the only published Resolute source version of `kf6-kglobalaccel`, in the Release pocket. The local apt candidate is also that version. The report is a backport request, not a claim that current upstream still has the bug. ## Upstream references - Confirmed/fixed issue: https://bugs.kde.org/show_bug.cgi?id=524700 - Fix: https://invent.kde.org/frameworks/kglobalaccel/-/commit/262cc713ac6444498509170749eb4c5ce2f6c7ae - Fixed release source: https://invent.kde.org/frameworks/kglobalaccel/-/blob/v6.30.0/src/kglobalshortcutinfo_dbus.cpp - Related earlier Ubuntu/Kubuntu report: https://bugs.kde.org/show_bug.cgi?id=523572 ## Attachments and privacy The attached backtrace was obtained offline from the existing crash, using matching debug-symbol packages extracted into a temporary directory, not installed on the system. It includes the relevant library and KWin entry-point symbols. Two unrelated Brotli mappings in the old core differ from the currently installed libraries after an unattended update; neither is on the crashing thread's stack. Only sanitized stack and evidence text are offered. The raw Apport report, core dump, process environment, unrestricted journals and originating agent transcript are intentionally excluded because they can contain private data. ** Affects: kf6-kglobalaccel (Ubuntu) Importance: Undecided Status: New ** Attachment added: "Sanitized symbolized crashing-thread backtrace (28 frames; no raw memory)" https://bugs.launchpad.net/bugs/2172649/+attachment/6013908/+files/backtrace.txt -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172649 Title: [resolute] Short QKeySequence D-Bus argument aborts KWin Wayland; please backport KDE bug 524700 fix To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/kf6-kglobalaccel/+bug/2172649/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
