Public bug reported:
**Package:** fontconfig 2.17.1-3ubuntu1 (fontconfig-config, libfontconfig1 same
version)
**Also installed:** libqt6gui6 6.10.2+dfsg-7
**System:** Kubuntu 26.04 LTS, KDE Plasma 6.6.6, Wayland, kernel
7.0.0-34-generic
### What happened
Qt6/KDE applications (plasmashell, konsole, kate, krunner, and once Chrome)
crashed
repeatedly with SIGSEGV over several hours. All backtraces share the same chain:
#6 libfontconfig.so.1 (unknown frame)
#7 FcCharSetHasChar () from libfontconfig.so.1
#8 QFontEngineMultiFontConfig::shouldLoadFontEngineForCharacter(int,
unsigned int) const
#9 QFontEngineMulti::stringToCMap(QChar const*, int, QGlyphLayout*, int*,
QFlags<QFontEngine::ShaperFlag>) const
#10 QTextEngine::shapeText(int) const
#11 QTextEngine::shapeLine(QScriptLine const&)
In the crashing frame register rax = 0xfefefefefefefefe, i.e. fontconfig
dereferenced what looks like an uninitialised/poisoned FcCharSet pointer.
### What was ruled out
- `dpkg -V` for fontconfig, fontconfig-config, libfontconfig1: no differences.
- No recent fontconfig or Qt package updates before the crashes began.
- The font files themselves are not the cause (same fonts and rules work with a
clean cache).
- Plasma widgets / third-party plasmoids are not the cause.
### Isolation
- Running plasmashell with FONTCONFIG_FILE pointing to a copy of the same
fonts/rules and an empty cache in /tmp: no crash.
- A copy of /var/cache/fontconfig placed in /tmp: no crash.
- A copy of the affected ~/.cache/fontconfig: plasmashell crashed.
- Renaming ~/.cache/fontconfig and letting fontconfig rebuild it fixed
plasmashell.
### Cache layout after rebuild
~/.cache/fontconfig contains 32 entries x cache-12 plus symlinks cache-9/10/11
-> cache-12
(128 files, none zero-sized, no dangling links). /var/cache/fontconfig contains
only cache-9 (32 files).
### Not known
- Why the user cache became corrupted in the first place (no filesystem errors
noticed;
cause unknown).
- I could not reproduce the crash on the rebuilt cache. Processes started
before the
cache was rebuilt kept crashing (a konsole started earlier crashed at 12:46
after the
rebuild at 12:41), which suggests they held the old cache mapped in memory.
This is a hypothesis.
- Whether the bug is in fontconfig (missing validation of a corrupted cache) or
whether the cache was damaged externally.
### Expected behaviour
A corrupted or stale user cache should be detected and ignored/regenerated by
fontconfig
instead of causing a segfault in FcCharSetHasChar.
### Attachments
Backtraces (`coredumpctl gdb <PID> -A '-batch -ex "bt 12"'`) are pasted below.
Full core dumps and .crash files are NOT attached because they contain process
memory.
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=11,
no_tid=0) at ./nptl/pthread_kill.c:44
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=11,
no_tid=0) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (threadid=<optimized out>, signo=11) at
./nptl/pthread_kill.c:89
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at
./nptl/pthread_kill.c:100
#3 0x0000749ee3445b7e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
#4 0x0000749ee5496d8d in KCrash::defaultCrashHandler(int) () from
/usr/lib/x86_64-linux-gnu/libKF6Crash.so.6
#5 <signal handler called>
#6 0x0000749ee24484fc in ?? () from
/usr/lib/x86_64-linux-gnu/libfontconfig.so.1
#7 0x0000749ee2448f79 in FcCharSetHasChar () from
/usr/lib/x86_64-linux-gnu/libfontconfig.so.1
#8 0x0000749ee481065c in
QFontEngineMultiFontConfig::shouldLoadFontEngineForCharacter(int, unsigned int)
const () from /usr/lib/x86_64-linux-gnu/libQt6Gui.so.6
#9 0x0000749ee4646323 in QFontEngineMulti::stringToCMap(QChar const*, int,
QGlyphLayout*, int*, QFlags<QFontEngine::ShaperFlag>) const () from
/usr/lib/x86_64-linux-gnu/libQt6Gui.so.6
#10 0x0000749ee46b20bd in QTextEngine::shapeText(int) const () from
/usr/lib/x86_64-linux-gnu/libQt6Gui.so.6
#11 0x0000749ee46b2c2f in QTextEngine::shapeLine(QScriptLine const&) () from
/usr/lib/x86_64-linux-gnu/libQt6Gui.so.6
Config file used: ~/.config/fontconfig/fonts.conf (2054 bytes) — can
attach if requested.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: fontconfig 2.17.1-3ubuntu1
ProcVersionSignature: Ubuntu 7.0.0-34.34-generic 7.0.14
Uname: Linux 7.0.0-34-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Thu Sep 24 13:04:02 2026
InstallationDate: Installed on 2026-06-23 (93 days ago)
InstallationMedia: Kubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423)
SourcePackage: fontconfig
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: fontconfig (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168420
Title:
libfontconfig: SIGSEGV in FcCharSetHasChar (rax=0xfefefefefefefefe)
in Qt6 apps with a user font cache in ~/.cache/fontconfig
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/fontconfig/+bug/2168420/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
