Package: tmux Version: 3.5a-3 Severity: important The tmux server segfaults
when a `run-shell` client disconnects while its command is still running
and the command then produces output. Every session on that server is lost.
We hit it in practice: a service polling `tmux run-shell` crashed the
server when it restarted mid-poll.   Reproducer (private socket, safe to
run): tmux -L t -f /dev/null new-session -d 'sleep 600' tmux -L t run-shell
'sleep 1; echo x' & sleep 0.3; kill $! sleep 2; tmux -L t ls # "no server
running" Without output (`run-shell 'sleep 1'`), or when the client is not
killed, the server survives. Kernel log: `tmux: server[…]: segfault at
100cc … in tmux[728f2,…]`; with the trixie debug symbols, 0x728f2 is
proc_send (proc.c:171, `peer->flags` of an already freed peer). Upstream
fix: commit 4cc45aa719a527457ec0d88dcbc7216ca3be2b7e (nicm, 2026-07-26),
"Do not try to write to clients which have died, GitHub issue 5431", first
released in 3.8. It is one line in file.c; against 3.5a: --- a/file.c +++
b/file.c @@ -176,6 +176,7 @@ { if (c == NULL || (c->flags &
CLIENT_ATTACHED) || + (c->flags & CLIENT_DEAD) || (c->flags &
CLIENT_CONTROL)) return (0); return (1); Found by bisecting 3.7..3.8 with
the reproducer above (3.6 and 3.7 crash too). Verified on 3.5a: the
unpatched build crashes on the reproducer (3 of 3 servers), the same build
with this line applied survives (3 of 3). Upstream also added a regression
test for it ("Test run-shell if killed").

Sorry, my mail client flattened the first report into one paragraph
(and with it the pseudo-header). Here it is again, readable; the fix is
also attached as tmux-file-skip-dead-clients.patch.

The tmux server segfaults when a `run-shell` client disconnects while
its command is still running and the command then produces output.
Every session on that server is lost. We hit it in practice: a service
polling `tmux run-shell` crashed the server when it restarted mid-poll.

Reproducer (private socket, safe to run):

    tmux -L t -f /dev/null new-session -d 'sleep 600'
    tmux -L t run-shell 'sleep 1; echo x' & sleep 0.3; kill $!
    sleep 2; tmux -L t ls    # "no server running"

Without output (`run-shell 'sleep 1'`), or when the client is not
killed, the server survives.

Kernel log: `tmux: server[...]: segfault at 100cc ... in tmux[728f2,...]`;
with the trixie debug symbols, 0x728f2 is proc_send (proc.c:171,
`peer->flags` of an already freed peer).

Upstream fix: commit 4cc45aa719a527457ec0d88dcbc7216ca3be2b7e (nicm,
2026-07-26), "Do not try to write to clients which have died, GitHub
issue 5431", first released in 3.8. It is one line in file.c; against
3.5a:

--- a/file.c
+++ b/file.c
@@ -176,6 +176,7 @@
 {
  if (c == NULL ||
     (c->flags & CLIENT_ATTACHED) ||
+    (c->flags & CLIENT_DEAD) ||
     (c->flags & CLIENT_CONTROL))
  return (0);
  return (1);

Found by bisecting 3.7..3.8 with the reproducer above (3.6 and 3.7
crash too). Verified on 3.5a: the unpatched build crashes on the
reproducer (3 of 3 servers), the same build with this line applied
survives (3 of 3). Upstream also added a regression test for it
("Test run-shell if killed").

Kenneth