Subject: Additional affected system: GCR ssh-add children consume five CPU cores on Ubuntu 26.04.1
Observed on 2026-10-31. This is an additional field report consistent with Ubuntu bug 2170680 and potentially related to GNOME/gcr issue 135. The precise internal failure mechanism has not been established on this system. Environment Ubuntu 26.04.1 LTS, x86_64 Linux 7.0.0-42-generic gcr4 4.4.0.1-8 gnome-keyring 50.0-1 gnome-shell 50.1-0ubuntu1.4 openssh-client 1:10.2p1-2ubuntu3.8 SSH_AUTH_SOCK=/run/user/1000/gcr/ssh Default ED25519 key is passphrase-protected (OpenSSH cipher aes256-ctr, KDF bcrypt). Observed behaviour Five /usr/bin/ssh-add processes were children of /usr/libexec/gcr-ssh-agent --base-dir /run/user/1000/gcr. Each command was ssh-add ~/.ssh/id_ed25519 (home path redacted). A three-second /proc CPU sample measured 98.8%, 98.1%, 97.8%, 97.5%, and 97.2% of one logical CPU core, respectively. The machine has eight logical CPU cores, so these processes occupied almost five cores concurrently. Four children had existed for more than two days; the fifth had recently appeared. Each child had stdin and stdout connected to /dev/null, stderr to a pipe, and another open socket descriptor. The public GCR socket returned one identity to a bounded ssh-add -l query (exit 0). The backing socket /run/user/1000/gcr/.ssh returned exit 1 for ssh-add -l, indicating no loaded identities. No live ssh signing trace or syscall trace was captured before termination. No conclusion is drawn about whether a cached passphrase was stale or incorrect. DISPLAY and WAYLAND_DISPLAY were absent from the running GCR process environment; this observation alone does not establish causality. Mitigation and verification All five identity-verified children terminated with SIGTERM; SIGKILL was not needed. Subsequent checks found no remaining ssh-add processes, and follow-up CPU sampling showed no per-process core saturation. Configured the OpenSSH client with Host * / IdentityAgent none to bypass GCR. Verified ssh -G for all seven existing host aliases plus hamgit.ir, github.com and a fallback test hostname: identityagent none was effective and every other effective configuration line was unchanged. An actual interactive SSH login with the workaround has not yet been tested, because entering the private-key passphrase requires the user. Private key material, passphrases, fingerprints, remote host addresses and full session logs are intentionally excluded. Expected behaviour Unlock the key successfully, present an appropriate prompt, or return a bounded failure. Failed unlock attempts must not leave permanently CPU-bound ssh-add children. Related reports Ubuntu: https://bugs.launchpad.net/ubuntu/+source/gcr4/+bug/2170680 Upstream: https://gitlab.gnome.org/GNOME/gcr/-/work_items/135 These links are references to existing reports, not evidence that this local report has been submitted. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170680 Title: gcr-ssh-agent hangs/spins forever when signing with a passphrase- protected ssh-ed25519 key To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/gcr4/+bug/2170680/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
