Public bug reported: # Plymouth on Ubuntu 26.04: cancelled password prompt remains active after client disconnect
**Suggested Launchpad package:** `plymouth` (Ubuntu 26.04 / resolute) ## Summary A systemd password requester can be cancelled and its request/socket removed, but Plymouth still retains the old password prompt. A subsequent new password request is not displayed or answered until the stale prompt is drained. This prevents reliable switching between FIDO2 unlock and LUKS recovery-key entry in early boot. The issue was reproduced using installed Ubuntu 26.04.1 LTS Plymouth `24.004.60+git20250831.4a3c171d-0ubuntu8` with systemd `259.5-0ubuntu3.4`. It was also reproduced using a separately compiled unmodified Ubuntu Plymouth source package, and resolved in an otherwise identical build with an adapted upstream cancellation fix. ## Impact Cancellation of an existing Plymouth password prompt does not reliably make the next prompt available. When used in an initramfs password-agent workflow this may prevent the user from entering an alternative unlocking secret after cancelling a previous request. No loss of LUKS key material or bypass of disk encryption was demonstrated; this is a prompt lifecycle and availability issue. The isolated test uses only fixed public dummy strings, never real credentials. ## Test environment - Ubuntu 26.04.1 LTS (resolute), x86_64 - Installed Plymouth: `24.004.60+git20250831.4a3c171d-0ubuntu8` - systemd: `259.5-0ubuntu3.4` - Build system: Meson 1.10.1, GCC 15.2.0 - Upstream commit examined: `f3461296ae847e758b0795273d9660b8755d9665` - A and B both built from the exact Ubuntu `0ubuntu8` source, with the same compiler and Meson flags. Both were launched in separate PID, mount, network and IPC namespaces with a private text-mode Plymouth instance and private PTY. Each test used a private systemd password request agent. ## Steps to reproduce (conceptual) 1. Start an isolated Plymouth text daemon and a `systemd-tty-ask-password-agent --watch --plymouth` agent. 2. Submit and answer an initial public dummy password request. Verify the agent works. 3. Submit a second password request, wait until Plymouth displays it, then cancel it via systemd's ask-password cancellation protocol (datagram `-` to its private response socket). 4. Confirm the requester exited and its ask file/socket were removed. 5. Submit a new public dummy password request. Observe whether Plymouth shows this new prompt and accepts its answer before the request timeout. As a positive control, repeat the scenario without cancellation. As a diagnostic control, insert a dummy response to drain the old prompt after cancelling but before submitting the next request. ## Observed A/B results | Scenario | Unmodified Ubuntu source (A) | Same source plus upstream fix (B) | |---|---|---| | Sequential requests without cancellation | PASS | PASS | | Cancel request, then submit another | FAIL — new request remains pending | PASS — next request accepted | | Cancel, drain old prompt with public dummy text, then submit another | PASS | PASS | Reproduction markers: ```text A_B_SCENARIO=ubuntu-original/control:0 A_B_SCENARIO=ubuntu-original/cancel:2 A_B_SCENARIO=ubuntu-original/preflush:0 A_B_SCENARIO=ubuntu-patched/control:0 A_B_SCENARIO=ubuntu-patched/cancel:0 A_B_SCENARIO=ubuntu-patched/preflush:0 ``` The unmodified variant reports `NEW_REQUEST_NOT_ANSWERED; pending well before 40s requester timeout`. The patched variant reports `PASS_CANCEL_NEXT_PROMPT`. ## Upstream fix / proposed SRU direction Upstream Plymouth commit: - https://github.com/jhnc- oss/plymouth/commit/f3461296ae847e758b0795273d9660b8755d9665 This change associates pending password and keystroke requests with the originating client connection, cancels them when that client disconnects, and clears the typed-text buffer for the active prompt. The previous use-after-free protection from commit `9f892393675d19d17b900fd12c9c5cb27762a8e3` was already present in the Ubuntu upstream base snapshot used by this package. Port notes: one constructor assignment was adapted to context changes in the Ubuntu source package; the upstream test-only `PLY_BOOT_SOCKET_PATH` socket override was not used, since the A/B harness already has a private network namespace. All other relevant patch hunks applied cleanly. The modified package has not been installed on the system. ## Regression risk and remaining verification The test compared two self-compiled text-mode Plymouth daemons, not graphical BGRT and not a real LUKS unlock. It confirms the observed lifecycle regression in the isolated text environment only. Before a production update, the proposed fix should be tested with: partially typed public dummy input before cancellation, graphical BGRT password prompts, nested/queued requests, rapid cancellation and recreation, process disconnect during partial request, and a full initramfs regression test. A fix for cancellation does not in itself implement an F2 keyboard shortcut or an unlock-method switch. **Request:** Consider backporting the upstream prompt-cancellation fix to Ubuntu 26.04 LTS via the normal SRU process, with an appropriate regression test. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: plymouth 24.004.60+git20250831.4a3c171d-0ubuntu8 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Mon Oct 19 08:13:10 2026 DefaultPlymouth: /usr/share/plymouth/themes/bgrt/bgrt.plymouth InstallationDate: Installed on 2026-10-15 (4 days ago) InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: ASUSTeK COMPUTER INC. ASUS TUF Dash F15 FX516PM_FX516PM ProcCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-38-generic root=/dev/mapper/vgubuntu-lvroot ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-38-generic root=/dev/mapper/vgubuntu-lvroot ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: plymouth TextPlymouth: /usr/share/plymouth/themes/ubuntu-text/ubuntu-text.plymouth UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 05/15/2023 dmi.bios.release: 5.19 dmi.bios.vendor: American Megatrends International, LLC. dmi.bios.version: FX516PM.330 dmi.board.asset.tag: ATN12345678901234567 dmi.board.name: FX516PM dmi.board.vendor: ASUSTeK COMPUTER INC. dmi.board.version: 1.0 dmi.chassis.asset.tag: No Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: ASUSTeK COMPUTER INC. dmi.chassis.version: 1.0 dmi.ec.firmware.release: 3.16 dmi.modalias: dmi:bvnAmericanMegatrendsInternational,LLC.:bvrFX516PM.330:bd05/15/2023:br5.19:efr3.16:svnASUSTeKCOMPUTERINC.:pnASUSTUFDashF15FX516PM_FX516PM:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnFX516PM:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:sku:pfaASUSTUFDashF15: dmi.product.family: ASUS TUF Dash F15 dmi.product.name: ASUS TUF Dash F15 FX516PM_FX516PM dmi.product.version: 1.0 dmi.sys.vendor: ASUSTeK COMPUTER INC. ** Affects: plymouth (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute wayland-session ** Patch added: "plymouth-ubuntu-26.04-fix-cancelled-prompts.patch" https://bugs.launchpad.net/bugs/2171381/+attachment/6010460/+files/plymouth-ubuntu-26.04-fix-cancelled-prompts.patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171381 Title: Plymouth password prompt remains active after client disconnect on Ubuntu 26.04 LTS To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/plymouth/+bug/2171381/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
