Bug#1148082: gnome-keyring: gnome-keyring-daemon segfaults in libgck-1 after 50.0-1 -> 51.0-1 upgrade

Wed Sep 16 20:46:32 BST 2026

Package: gnome-keyring
Version: 51.0-1
Severity: important
X-Debbugs-Cc:

Dear Maintainer,

After the upgrade from gnome-keyring 50.0-1 to 51.0-1 (together with
gcr4/libgck-2-2/libgcr-4-4 4.4.0.1-8+b2 -> 4.4.1-2 on the same day),
gnome-keyring-daemon started segfaulting repeatedly whenever a client
tries to unlock or write to the "login" collection (e.g. GNOME Online
Accounts saving an OAuth2 token, or a GUI password prompt completing).

This makes the secrets service effectively unusable: every application
that stores or retrieves a secret (Evolution's IMAP/SMTP passwords,
GNOME Online Accounts tokens, the SSH agent component) has to re-ask
for credentials every session, because gnome-keyring-daemon dies and
restarts with an empty/locked state in the middle of the operation.

Downgrading gnome-keyring, gnome-keyring-pkcs11 and libpam-gnome-
keyring
back to 50.0-1 (from snapshot.debian.org) immediately fixed the
problem; the daemon has been stable for hours since the downgrade,
with the exact same ~/.local/share/keyrings contents and the exact
same SSH keys in ~/.ssh.

Steps to reproduce
-------------------
1. Have a "login" keyring that gnome-keyring-daemon manages (default
   setup, PAM auto-unlock via pam_gnome_keyring).
2. Trigger a secret prompt/unlock, e.g.:
   - Open Evolution and let it ask for the IMAP/SMTP password, or
   - Add/refresh a Google account in GNOME Online Accounts (OAuth2
     token needs to be stored), or
   - Simply restart gnome-keyring-daemon and unlock the keyring via
     the gcr-prompter dialog.
3. gnome-keyring-daemon crashes with SIGSEGV a few seconds after the
   secret exchange with gcr-prompter completes.
4. systemd restarts the (systemd --user) service, which comes back
   with the collection locked again, so every stored secret has to be
   re-entered.

Observed crash (journalctl --user -u gnome-keyring-daemon.service)
--------------------------------------------------------------------
sep 16 20:46:07 host gcr-prompter[60485]: Gcr: completed password
prompt for callback :1.165@/org/gnome/keyring/Prompt/p3
sep 16 20:46:07 host gcr-prompter[60485]: Gcr: calling the PromptDone
method on /org/gnome/keyring/Prompt/p3@:1.165, and ignoring reply
sep 16 20:46:07 host systemd[1476]: gnome-keyring-daemon.service: Main
process exited, code=killed, status=11/SEGV
sep 16 20:46:07 host kernel: gnome-keyring-d[55426]: segfault at
f00dface ip 00007fa0a06e7482 sp 00007ffd1da93770 error 4 in libgck-
1.so.0.0.0[1d482,7fa0a06d4000+1d000] likely on CPU 0 (core 0, socket 0)
sep 16 20:46:07 host kernel: Code: 18 00 00 00 00 48 85 ff 0f 84 9a 00
00 00 48 89 fb 48 89 f5 49 89 d4 49 89 cd e8 d9 d6 fe ff 48 89 c6 48 8b
03 48 85 c0 74 05 <48> 39 30 74 0c 48 89 df e8 d1 d7 fe ff 85 c0 74 6d
48 85 ed 0f 84

The fault address (0xf00dface) looks like a memory-poisoning pattern,
suggesting a use-after-free/double-free rather than a plain NULL
pointer bug.

The same boot also shows repeated warnings just before some of the
earlier crashes, which may be related to the same underlying state
corruption:

  gnome-keyring-daemon[NNNN]: asked to register item
    /org/freedesktop/secrets/collection/login/N, but it's already
registered
  gnome-keyring-daemon[NNNN]: Gck: gck_session_find_objects: assertion
    'GCK_IS_SESSION (self)' failed
  gnome-keyring-daemon[NNNN]: GLib-GObject: g_object_unref: assertion
    'G_IS_OBJECT (object)' failed

Note: libgck-1-0 itself stayed at 3.41.2-6+b1 across the whole
timeframe (it did not get upgraded on 2026-09-15), so the regression
looks like it's in gnome-keyring's own use of libgck's PKCS#11/GObject
API rather than in libgck-1-0 itself.

Workaround
----------
Downgrade and hold at 50.0-1:

  sudo dpkg -i gnome-keyring_50.0-1_amd64.deb \
               gnome-keyring-pkcs11_50.0-1_amd64.deb \
               libpam-gnome-keyring_50.0-1_amd64.deb
  sudo apt-mark hold gnome-keyring gnome-keyring-pkcs11 libpam-gnome-
keyring

(.debs pulled from snapshot.debian.org,
archive/debian/20260317T150720Z/)

I don't have a symbolized backtrace (no gnome-keyring-dbgsym/systemd-
coredump
installed at the time), only the kernel oops line above. Happy to
install dbgsym packages and reproduce with 51.0-1 again to get a
proper `bt full` under gdb if that's useful — let me know.

-- System Information:
Debian Release: forky/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64

Kernel: Linux 7.1.13+deb14-amd64 (SMP w/ PREEMPT_DYNAMIC)
Locale: LANG=es_ES.UTF-8, LC_CTYPE=es_ES.UTF-8 (charmap=UTF-8),
LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash, /bin/bash linked to
/usr/bin/bash
Init: systemd (via /run/systemd/system)

Versions of packages gnome-keyring depends on:
ii  dbus                    1.16.2-5+b1
ii  libgcrypt20             1.12.3-2
ii  libglib2.0-0t64         2.90.0-1
ii  libp11-kit0             0.26.5-1
ii  libgck-1-0              3.41.2-6+b1
ii  gcr4                    4.4.1-2
ii  libgck-2-2              4.4.1-2
ii  libgcr-4-4              4.4.1-2

-- no debconf information