Public bug reported:
NOTE: this text is AI generated
----
`gnome-shell` reliably segfaults in `meta_output_kms_read_edid()` shortly after
resuming from suspend (S3), killing the entire Wayland session. It has happened
twice, both times at the **same code offset** (`libmutter-14.so.0 + 0x17d816`),
so it is not a random memory error.
The crash is reached from an **external D-Bus call** to
`org.gnome.Mutter.DisplayConfig.GetResources`, served while the KMS outputs are
still being re-probed after resume.
### Versions
```
mutter / libmutter-14-0 46.2-1ubuntu0.24.04.16
gnome-shell 46.0-0ubuntu6~24.04.14
kernel 7.0.0-31-generic (HWE)
Ubuntu 24.04.4 LTS (noble)
session Wayland
```
### Hardware
```
GPU 0 Intel TigerLake-H GT1 [UHD Graphics] [8086:9a60] ← drives all outputs
GPU 1 NVIDIA TU117GLM [T600 Mobile] [10de:1fba] ← PRIME offload only
driver nvidia 580.173.02
outputs eDP-1 (internal panel) + DP-1 (external monitor via Thunderbolt 4 dock)
```
Laptop with a Thunderbolt 4 controller at PCI `00:0d.0` hosting the
dock.
### Steps to reproduce
1. Suspend the laptop (`systemctl suspend` or `suspend-then-hibernate`), with an
external monitor attached through a Thunderbolt dock — or attached while the
machine is resuming.
2. Resume.
3. `gnome-shell` segfaults ~160 ms after userspace is unfrozen. The session is
terminated and the user is dropped back to all
running applications are lost.
Not every resume crashes: a 14-second suspend
15-hour one did. The common factor appears to
controller powers down, and therefore how muchs on
resume.
### Symbolised backtrace
Resolved with `addr2line` against `libmutter-14.16`
(the trace recorded in the journal only had of
afterwards, so `coredumpctl info` still shows
```
#0 meta_output_kms_read_edid 0 + 0x17d816)
#1 meta_monitor_manager_handle_get_resources (libmutter-14.so.0 +
0x9cc4a)
#2 _g_dbus_codegen_marshal_BOOLEAN__OBJECT -config.c:241
#3 g_closure_invoke
#4 g_signal_emitv
#5 _meta_dbus_display_config_skeleton_handle_method_call
meta-dbus-display-config.c:3506
#6 (libgio-2.0.so.0 + 0x129df3)
#7 (libgio-2.0.so.0 + 0x10dc08)
#8 g_main_loop_run
#9 meta_context_run_main_loop 0 + 0xd50aa)
```
### Faulting instruction
The kernel logged the code bytes around the fa
```
Code: ... 48 8b 7f 18 e8 aa ff ff ff <48 8
mov rdi,[rdi+0x18] call … mov
```
A call returns **NULL in `rax`** and the retur0x40`
without being checked — hence `segfault at 40`
Note that the very next instruction (`test rbxd
value for NULL. So a NULL check exists, but itd
rather than on the pointer that was returned.
Kernel message:
```
gnome-shell[…]: segfault at 40 ip …15f7d816 sp
in libmutter-14.so.0.0.0[17d816,…+167000]
```
### Timeline (kernel monotonic clock)
```
[29860.346] xhci_hcd 0000:00:0d.0: xHC error in resume, USBSTS 0x411, Reinit
[29860.346] usb usb1/usb2: root hub lost powe
[29861.006] Restarting tasks: Starting
[29861.006] usb 3-3: USB disconnect, device n
[29861.013] Restarting tasks: Done
[29861.120] usb 3-3: new full-speed USB devic
[29861.137] psmouse serio1: synaptics: querie
[29861.169] psmouse serio1: synaptics: querie
[29861.175] gnome-shell segfault
[29861.233] usb 2-1: new SuperSpeed USB devic crash)
```
The crash lands in the middle of device re-enunput
devices are re-probed, and **before** the dock's own devices appear — so
`GetResources` is being served while output/KM
### Impact
The whole Wayland session dies and every open
requires a fresh login. On a laptop that is re
### What was ruled out
- **Not a regression from a recent update.** The same kernel (7.0.0-31) and the
same mutter (46.2-…16, released 2026-06-17) clean
reinstall of the machine, on which the crash
- **Not a third-party GNOME extension.** The f
installation of the only two third-party ext
- **Not local systemd sleep hooks.** They run rash.
- **Not the dock's own re-enumeration.** Its devices appear after the crash.
### Related but distinct
- LP #2148655 — same class (NULL deref on monime)
but a different function (`meta_logical_monitter
50.x / Ubuntu 26.04. Fixed in 50.1-0ubuntu2.1; no equivalent fix exists for
46.2 in noble.
- mutter MR !172 — adds a NULL check when `drmULL.
** Affects: mutter (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166959
Title:
gnome-shell crashed with SIGSEGV in meta_output_kms_read_edid when
GetResources is called during resu me from suspend
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2166959/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
