Hi Joshua, Thanks for the follow-up. SRU information below.
[ Impact ] Connecting a Bluetooth headset on Ubuntu 26.04 aborts Cinnamon and csd-media-keys. The X server stays up. cinnamon-launcher then tries to start metacity, which is not installed, so the session loses its panel and window manager. libcvc 6.4.2-1 calls g_assert_not_reached() in gvc_mixer_stream_get_port() when PipeWire 1.5.84+ drops the stream's active port during the BlueZ profile switch. Current cinnamon-desktop master returns NULL instead, but three callers still dereference it (gvc_mixer_control_lookup_device_from_stream, change_output and change_input), so the abort becomes a NULL segfault. The upload removes the assert and skips those three dereferences, the same way update_sink and update_source already do. A missing port is treated as a port change. [ Test Plan ] An autopkgtest cannot reproduce this. It needs a paired Bluetooth headset and the PipeWire port-list race during A2DP connect. On a Cinnamon session with PipeWire, a paired headset, and cinnamon-desktop 6.4.2-1: 1. Note the PID of the cinnamon process. 2. Connect the headset, then disconnect it. Repeat three times. 3. Broken package: cinnamon and csd-media-keys die. The journal shows either "gvc_mixer_stream_get_port: code should not be reached" or "segfault at 0 in libcvc.so.0". 4. Fixed package: the cinnamon PID does not change, and the journal has no new segfault and no "code should not be reached". 5. Confirm the volume applet still lists the speaker and the headset, and that playback switches to the headset while it is connected. This was done locally on Ubuntu 26.04.1, Cinnamon 6.4.13, PipeWire 1.6.2, WirePlumber 0.5.13: three connect/disconnect cycles, same cinnamon PID, no new segfault. [ Where problems could occur ] The change is in the path that picks the active mixer port when the output or input device changes. If the NULL check is wrong, Cinnamon can keep the previous output instead of moving playback to the headset, or the volume applet can omit the device that just appeared. A bad change_port() call can leave the stream on the wrong port until the user selects the device again. Speaker, HDMI and non-Bluetooth streams are only affected when their active port is also missing from the port list. [ Other Info ] Upstream issue linuxmint/cinnamon-desktop#267 removed the assert and was closed. The three remaining callers are in https://github.com/linuxmint/cinnamon-desktop/pull/278 The 6.4.2-1ubuntu1 debdiff does both, because 6.4.2 still has the assert: https://github.com/glira/cinnamon-bluetooth-crash-fix/blob/main/patches/cinnamon-desktop_6.4.2-1ubuntu1.debdiff Gemayel Lira On Wed, 14 Oct 2026 13:06:17 -0000 Joshua Peisach <[email protected]> wrote: > Hi, sorry for the late follow up! > > Could you fill out the SRU template? Thanks :) > https://ubuntu.com/project/docs/SRU/reference/bug-template/#reference- > sru-bug-template > > -- > You received this bug notification because you are subscribed to the bug > report. > https://bugs.launchpad.net/bugs/2170365 > > Title: > cinnamon crashes when a Bluetooth headset connects (libcvc NULL active > port) > > Status in cinnamon-desktop package in Ubuntu: > New > > Bug description: > affects ubuntu/cinnamon-desktop > importance medium > tags patch > > Connecting a Bluetooth headset on Ubuntu 26.04 kills Cinnamon and > csd-media-keys. X stays up. cinnamon-launcher then tries to start > metacity, which is not installed, so the session looks like the > display died. > > Package: cinnamon-desktop 6.4.2-1 (libcvc0t64) > Cinnamon: 6.4.13-2ubuntu0.2 > PipeWire: 1.6.2-1ubuntu1.2 > WirePlumber: 0.5.13-1ubuntu1 > > PipeWire 1.5.84 and later can drop a stream's active port while BlueZ > switches the headset profile. In 6.4.2, gvc_mixer_stream_get_port() > hits g_assert_not_reached() and aborts: > > Cvc:ERROR:../libcvc/gvc-mixer-stream.c:541:gvc_mixer_stream_get_port: > code should not be reached > cinnamon-settings-daemon-media-keys.desktop killed by signal 6 > > linuxmint/cinnamon-desktop#267 removed that assert on master (the > function now returns NULL) and the issue was closed. Three callers in > gvc-mixer-control.c still dereference the result: > gvc_mixer_control_lookup_device_from_stream, > gvc_mixer_control_change_output and gvc_mixer_control_change_input. > With only the assert removed, the same event is a NULL dereference: > > csd-media-keys: segfault at 0 in libcvc.so.0.0.0 > cinnamon: segfault at 0 in libcvc.so.0.0.0 > > update_sink and update_source already test for NULL. > > Pull request for current master, covering the three callers: > https://github.com/linuxmint/cinnamon-desktop/pull/278 > > Ubuntu debdiff for 6.4.2-1ubuntu1, which also drops the assert: > > https://github.com/glira/cinnamon-bluetooth-crash-fix/blob/main/patches/cinnamon-desktop_6.4.2-1ubuntu1.debdiff > > Verified locally after the NULL checks: three Bluetooth > disconnect/connect cycles, the cinnamon PID did not change, and the > journal had no new segfault. > > Gemayel Lira > > To manage notifications about this bug go to: > https://bugs.launchpad.net/ubuntu/+source/cinnamon-desktop/+bug/2170365/+subscriptions > > -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170365 Title: cinnamon crashes when a Bluetooth headset connects (libcvc NULL active port) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cinnamon-desktop/+bug/2170365/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
