#1152996 libxkbregistry0: dangling XML error handler crashes GNOME Shell when parsing weather data

Package:
libxkbregistry0
Source:
libxkbregistry0
Description:
library to query available RMLVO
Submitter:
adamhassan111
Date:
2026-11-04 14:07:01 UTC
Severity:
normal
Tags:
#1152996#5
Date:
2026-11-04 09:00:54 UTC
From:
To:
On Debian 13 amd64, GNOME Shell 48.7 repeatedly segfaulted,
returning me to the login screen. This affected both normal
GNOME and GNOME Classic, including while idle, and occurred
with third-party extensions disabled.

A core dump with matching debug symbols showed:

invalid callback address
rxkb_log src/registry.c:149
xml_error_func src/registry.c:1151
xmlReportError / __xmlRaiseError
xmlParseMemory
parse_forecast_xml_new libgweather/weather-metno.c:304
metno_finish_new libgweather/weather-metno.c:423

The XML error was:
"Premature end of data in tag location line 133"

This matches the known dangling libxml2 error-handler bug:
https://github.com/xkbcommon/libxkbcommon/issues/529

Upstream fix:
https://github.com/xkbcommon/libxkbcommon/pull/530

Before upgrading, a standalone test confirmed the XML error
handler still referenced the freed registry context.

Upgrading the libxkbcommon family to 1.13.1-1~bpo13+1 from
trixie-backports cleared the dangling handler. Parsing
malformed XML afterward no longer crashes the test process.

Could the upstream fix also be included in Debian 13 stable?

#1152996#10
Date:
2026-11-04 12:57:57 UTC
From:
To:
I can reproduce this on Debian 13 (libxkbcommon 1.7.0-2, gnome-shell
48.7-0+deb13u2, libgweather 4.4.4-1, libxml2 2.9.14).

The gnome-shell session was terminated by SIGSEGV 5 times on 2026-11-04, 25
to 45 seconds after login. Backtrace from a core dump of the main thread:

#0 0x0000557800000001 in ?? ()
#1 libxkbregistry.so.0 (xml error callback)
#3 libxml2.so.2
#4 __xmlRaiseError
#9 xmlParseElement
#11 xmlParseMemory
#12 libgweather-4.so.0

This matches upstream issue #529, fixed in libxkbcommon 1.8.0 by commit
a47961b1 ("registry: Restore default libxml2 error handler after parsing").

Installing libxkbcommon0, libxkbregistry0 (amd64 and i386),
libxkbcommon-x11-0 and libxkbcommon-dev 1.13.1-1~bpo13+1 from
trixie-backports applies the fix. I am verifying it on this machine.

The fix is a small, self-contained change. Could it be included in a stable
update (trixie-proposed-updates) for libxkbcommon?

#1152996#15
Date:
2026-11-04 13:38:00 UTC
From:
To:
Hi,

Same crash here on Debian 13 (trixie), amd64, starting 2026-11-04.

Versions:
  libxkbregistry0 1.7.0-2
  libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3
  gnome-shell 48.7-0+deb13u2
  libgweather-4-0t64 4.4.4-1
  NVIDIA 615.71.10 (open), but the GPU driver is not involved

Symptoms: gnome-shell segfaults right after login on both X11 and
Wayland, gets restarted by systemd, and crashes again, until GDM gives
up ("GNOME Session Failed"). It happened 4-6 times per login. It was
triggered by a weather location (SCTC, Temuco) set in
org.gnome.shell.weather and by a weather extension. At the time,
aviationweather.gov was returning HTTP 404 (JSON) and api.met.no was
returning HTTP 502 (HTML), so libgweather tried to parse a non-XML
response.

Backtrace of the crashing thread (systemd-coredump; debug symbols for
libxkbregistry were not available, so its frames are offsets only):

  #0  0x00007f2b230365ff n/a (libxkbregistry.so.0 + 0x25ff)
  #1  0x00007f2b230368a2 n/a (libxkbregistry.so.0 + 0x28a2)
  #2  0x00007f2b225eac0e n/a (libxml2.so.2 + 0x36c0e)
  #3  0x00007f2b225ec73d __xmlRaiseError (libxml2.so.2 + 0x3873d)
  #4  0x00007f2b226028de n/a (libxml2.so.2 + 0x4e8de)
  #5  0x00007f2b22603e5f n/a (libxml2.so.2 + 0x4fe5f)
  #6  0x00007f2b2260bed8 n/a (libxml2.so.2 + 0x57ed8)
  #7  0x00007f2b2260ced0 xmlParseElement (libxml2.so.2 + 0x58ed0)
  #8  0x00007f2b2260d34a xmlParseDocument (libxml2.so.2 + 0x5934a)
  #9  0x00007f2b226112d9 xmlParseMemory (libxml2.so.2 + 0x5d2d9)
  #10 0x00007f2abf200932 n/a (libgweather-4.so.0 + 0x1d932)
  #11 0x00007f2b278c2c73 n/a (libgio-2.0.so.0 + 0xbac73)
  #12 0x00007f2b278c3913 n/a (libgio-2.0.so.0 + 0xbb913)
  #13 0x00007f2af00bc998 n/a (libsoup-3.0.so.0 + 0x6c998)
  #14 0x00007f2b278c2c73 n/a (libgio-2.0.so.0 + 0xbac73)
  #15 0x00007f2b278c3913 n/a (libgio-2.0.so.0 + 0xbb913)
  #16 0x00007f2af00b6fcb n/a (libsoup-3.0.so.0 + 0x66fcb)
  #17 0x00007f2b278c2c73 n/a (libgio-2.0.so.0 + 0xbac73)
  #18 0x00007f2b278c3913 n/a (libgio-2.0.so.0 + 0xbb913)
  #19 0x00007f2b278a2dcb n/a (libgio-2.0.so.0 + 0x9adcb)
  #20 0x00007f2b278c2c73 n/a (libgio-2.0.so.0 + 0xbac73)
  #21 0x00007f2b278c3913 n/a (libgio-2.0.so.0 + 0xbb913)
  #22 0x00007f2b2789f38c n/a (libgio-2.0.so.0 + 0x9738c)
  #23 0x00007f2b2788e155 n/a (libgio-2.0.so.0 + 0x86155)
  #24 0x00007f2b278c2c73 n/a (libgio-2.0.so.0 + 0xbac73)
  #25 0x00007f2b278c2cad n/a (libgio-2.0.so.0 + 0xbacad)
  #26 0x00007f2b276a83c5 n/a (libglib-2.0.so.0 + 0x5c3c5)
  #27 0x00007f2b276aa5f7 n/a (libglib-2.0.so.0 + 0x5e5f7)
  #28 0x00007f2b276ab05f g_main_loop_run (libglib-2.0.so.0 + 0x5f05f)
  #29 0x00007f2b2711ae82 meta_context_run_main_loop (libmutter-16.so.0 +
0x11ae82)
  #30 0x00007f2b263786ce n/a (libffi.so.8 + 0x76ce)
  #31 0x00007f2b2637797e n/a (libffi.so.8 + 0x697e)
  #32 0x00007f2b263781ab ffi_call (libffi.so.8 + 0x71ab)
  #33 0x00007f2b27501dae n/a (libgjs.so.0 + 0x56dae)
  #34 0x00007f2b275022de n/a (libgjs.so.0 + 0x572de)
  #35 0x00007f2b23f8d4ef n/a (libmozjs-128.so.0 + 0x18d4ef)
  #36 0x00007f2b23f7f160 n/a (libmozjs-128.so.0 + 0x17f160)
  #37 0x00007f2b23f8d1eb n/a (libmozjs-128.so.0 + 0x18d1eb)
  #38 0x00007f2b23f8d7b0 n/a (libmozjs-128.so.0 + 0x18d7b0)
  #39 0x00007f2b23f8da29 n/a (libmozjs-128.so.0 + 0x18da29)
  #40 0x00007f2b2403fab3
_ZN2JS4CallEP9JSContextNS_6HandleINS_5ValueEEES4_RKNS_16HandleValueArrayENS_13MutableHandleIS3_EE
(libmozjs-128.so.0 + 0x23fab3)
  #41 0x00007f2b27536482 n/a (libgjs.so.0 + 0x8b482)
  #42 0x00007f2b2753af2f n/a (libgjs.so.0 + 0x8ff2f)
  #43 0x00007f2b2753b092 gjs_context_eval_module (libgjs.so.0 + 0x90092)
  #44 0x00007f2b2753b189 gjs_context_eval_module_file (libgjs.so.0 +
0x90189)
  #45 0x00005608bbc209c6 n/a (/usr/bin/gnome-shell + 0x39c6)
  #46 0x00007f2b26e35ca8 n/a (libc.so.6 + 0x29ca8)
  #47 0x00007f2b26e35d65 __libc_start_main (libc.so.6 + 0x29d65)
  #48 0x00005608bbc20ce1 n/a (/usr/bin/gnome-shell + 0x3ce1)

The complete coredumpctl output, with all threads, is attached.

Several other cores from the same sessions crash at garbage addresses
(0x2, 0xdb, 0x1cc), which fits a call through the dangling
xml_error_func pointer.

Workaround 1: clearing the org.gnome.shell.weather and org.gnome.Weather
locations and removing the weather extensions stopped the crashes.

Workaround 2: libxkbcommon 1.13.1-1~bpo13+1 from trixie-backports
(libxkbcommon0, libxkbregistry0, libxkbcommon-x11-0) fixes it for me.
With the weather extension and location re-enabled, gnome-shell has had
no crashes since.

For what it's worth, since a weather server outage can stop a default
stable install from logging in at all, this might be a candidate for a
trixie point release. The upstream fix is commit a47961b1 ("registry:
Restore default libxml2 error handler after parsing", libxkbcommon
1.8.0), in case that helps.

Thanks!

#1152996#20
Date:
2026-11-04 14:05:05 UTC
From:
To:
Update: after installing libxkbcommon0, libxkbregistry0 (amd64 and i386),
libxkbcommon-x11-0 and libxkbcommon-dev 1.13.1-1~bpo13+1 from
trixie-backports and re-enabling GNOME weather and location services,
gnome-shell ran for 25 minutes without crashing. Before the update it
crashed within about a minute of login with the same settings. This
confirms that the upstream fix resolves the crash on Debian 13.