Fedora Account System
Red Hat Associate
Red Hat Customer
Nautilus (Files) on Fedora 44 crashes several times a week during normal use (clicking, hovering, dragging in file views). On this machine ABRT has recorded 17+ crashes since April 2026, alternating between SIGSEGV and SIGABRT ("corrupted size vs. prev_size"). No third-party Nautilus extensions are installed. The crashes match upstream GTK issue #8191, "DragSource race condition leads to corrupted memory": `drag_timeout()` in gtkdragsource.c writes a 4-byte timeout id into an already-freed GtkDragSource, which leaves nearby pointers with their low 32 bits zeroed. Depending on which object gets corrupted, the process later dies with SIGSEGV or is aborted by glibc's malloc checks. Evidence from a core dump on this machine (2026-08-25, SIGSEGV in gtk_css_node_set_invalid): the faulting address is 0x555d00000068 while the live object pointer in the same frame is 0x555d31a1fdf0 — i.e. a heap pointer whose low 32 bits were overwritten with zero. This is exactly the signature described in gtk#8191 / gtk#8173 / nautilus#4035. Upstream status: - Fixed in GTK 4.23.1 by commit 180d7ef4 (MR !9913): https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/9913 - Issue: https://gitlab.gnome.org/GNOME/gtk/-/issues/8191 - Backport to the gtk-4-22 stable branch is pending: https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/10188 - Nautilus maintainers closed the nautilus-side report as fixed by gtk#8191: https://gitlab.gnome.org/GNOME/nautilus/-/issues/4280 Fedora 44 ships gtk4-4.22.4-1.fc44 (also the newest build in updates-testing as of 2026-08-26), which does not contain the fix. Request: please backport commit 180d7ef4 (or the !10188 backport) into the Fedora 44 gtk4 package. Related ABRT-filed reports against nautilus that are most likely the same root cause: - https://bugzilla.redhat.com/show_bug.cgi?id=2521553 - https://bugzilla.redhat.com/show_bug.cgi?id=2511309 ## Version-Release number of selected component - gtk4-4.22.4-1.fc44.x86_64 - nautilus-50.2.2-2.fc44.x86_64 - glib2-2.88.3-1.fc44.x86_64 - kernel 7.1.9-200.fc44.x86_64, Wayland session (GNOME 50) Reproducible: Sometimes Steps to Reproduce: 1. Open Files (nautilus) in list view in a folder with many items. 2. Hover, click and drag items around for a while. 3. Eventually nautilus dies with SIGSEGV or SIGABRT. Actual Results: Nautilus window disappears; journal shows e.g.: nautilus[21811]: corrupted size vs. prev_size systemd-coredump: Process 21811 (nautilus) of user 1000 terminated abnormally with signal 6/ABRT Expected Results: No crash. Additional Information: Crash 1 — 2026-08-26 12:49, SIGABRT, "corrupted size vs. prev_size", main thread: #0 __pthread_kill_implementation (libc.so.6) #1 raise (libc.so.6) #2 abort (libc.so.6) #3 __libc_message_impl.cold (libc.so.6) #4 malloc_printerr (libc.so.6) #5 unlink_chunk.isra.0 (libc.so.6) #6 _int_free_create_chunk (libc.so.6) #7 _int_free_merge_chunk (libc.so.6) #8 _int_free_chunk (libc.so.6) #9 g_free (libglib-2.0.so.0) #10 datalist_destroy (libglib-2.0.so.0) #11 g_object_unref (libgobject-2.0.so.0) #12 _gtk_gesture_update_point (libgtk-4.so.1) #13 gtk_gesture_handle_event (libgtk-4.so.1) #14 gtk_gesture_single_handle_event (libgtk-4.so.1) #15 gtk_widget_run_controllers (libgtk-4.so.1) #16 _gtk_widget_captured_event (libgtk-4.so.1) #17 gtk_propagate_event_internal (libgtk-4.so.1) #18 gtk_main_do_event.part.0 (libgtk-4.so.1) #19 _gdk_marshal_BOOLEAN__POINTERv (libgtk-4.so.1) #20 gdk_surface_event_marshallerv (libgtk-4.so.1) #21 signal_emit_valist_unlocked (libgobject-2.0.so.0) #22 g_signal_emit_valist (libgobject-2.0.so.0) #23 g_signal_emit (libgobject-2.0.so.0) #24 gdk_surface_handle_event.isra.0 (libgtk-4.so.1) #25 gdk_event_source_dispatch.lto_priv.0 (libgtk-4.so.1) #26 g_main_context_dispatch_unlocked.lto_priv.0 (libglib-2.0.so.0) #27 g_main_context_iterate_unlocked.isra.0 (libglib-2.0.so.0) #28 g_main_context_iteration (libglib-2.0.so.0) #29 g_application_run (libgio-2.0.so.0) #30 main (nautilus) Crash 2 — 2026-08-25 22:49, SIGSEGV, si_addr = 0x555d00000068, main thread: #0 gtk_css_node_set_invalid (libgtk-4.so.1) #1 gtk_css_node_invalidate_style (libgtk-4.so.1) #2 gtk_css_node_invalidate (libgtk-4.so.1) #3 gtk_css_node_set_state (libgtk-4.so.1) #4 gtk_widget_propagate_state (libgtk-4.so.1) #5 gtk_widget_update_state_flags (libgtk-4.so.1) #6 set_widget_active_state.lto_priv.0 (libgtk-4.so.1) #7 gtk_window_set_pointer_focus_grab (libgtk-4.so.1) #8 gtk_main_do_event.part.0 (libgtk-4.so.1) #9 _gdk_marshal_BOOLEAN__POINTERv (libgtk-4.so.1) #10 gdk_surface_event_marshallerv (libgtk-4.so.1) #11 signal_emit_valist_unlocked (libgobject-2.0.so.0) #12 g_signal_emit_valist (libgobject-2.0.so.0) #13 g_signal_emit (libgobject-2.0.so.0) #14 gdk_surface_handle_event.isra.0 (libgtk-4.so.1) #15 gdk_event_source_dispatch.lto_priv.0 (libgtk-4.so.1) #16 g_main_context_dispatch_unlocked.lto_priv.0 (libglib-2.0.so.0) #17 g_main_context_iterate_unlocked.isra.0 (libglib-2.0.so.0) #18 g_main_context_iteration (libglib-2.0.so.0) #19 g_application_run (libgio-2.0.so.0) #20 main (nautilus) Core dumps for both crashes are available on request (coredumpctl, build-id 032bb7f6b3621f5a7f28f03573fb19611664282b for nautilus).
FEDORA-2026-f806ebcdbe (gtk4-4.22.4-2.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-f806ebcdbe
FEDORA-2026-f806ebcdbe has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-f806ebcdbe` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-f806ebcdbe See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-f806ebcdbe (gtk4-4.22.4-2.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.