Summary
Disconnecting an external HDMI monitor (either physically or via xrandr --output HDMI-1-0 --off) reliably crashes Xorg with SIGSEGV in nvidia_drv.so → wfbDestroyPixmap, killing the X session. A kernel WARNING in __nv_drm_handle_flip_event fires immediately before the crash. The bug reproduces on every NVIDIA driver version I have tested (580.119.02, 580.126.18, 580.142, 595.58.03 open kernel modules). It is not fixed by 595.58.03.
Hardware
- Laptop: MSI Vector 17 HX AI A2XWJG (MS-17S3)
- BIOS: E17S3IMS.110 (2025-11-14)
- dGPU: NVIDIA GeForce RTX 5090 Max-Q / Mobile (GB203M, Blackwell)
- iGPU: Intel Arrow Lake-S (hybrid/PRIME setup)
- External monitor: LG ULTRAWIDE, connected via HDMI (the laptop’s HDMI port is physically routed to the NVIDIA dGPU only —
/sys/class/drm/card0-HDMI-A-1→nvidiadriver)
Software
- Distribution: Fedora 43
- Kernel: 6.19.11-200.fc43.x86_64 (also reproduced on 6.18.12 and 6.18.13)
- Xorg: xorg-x11-server-Xorg 21.1.21
- Display manager: LightDM
- Desktop: XFCE 4.20 on X11
- Mesa: 25.3.6 (also tested 25.3.5, same crash)
nvidia-drm.modeset=1
Reproduction
- Boot with the HDMI monitor connected. XFCE dual-monitor setup works fine (laptop eDP via Intel, HDMI via NVIDIA).
- Either:
- physically unplug the HDMI cable, or
- run
xrandr --output HDMI-1-0 --off
- Xorg crashes with SIGSEGV. LightDM terminates the session.
Result is identical in both cases: the bug is not in hotplug event handling specifically, but in the CRTC teardown path itself.
Kernel WARNING (fires immediately before Xorg crash)
WARNING: nvidia-drm/nvidia-drm-crtc.h:322 at __nv_drm_handle_flip_event+0x19b/0x1b0 [nvidia_drm]
CPU: 7 PID: 1157 Comm: nvidia-modeset/ Tainted: G OE
RIP: 0010:__nv_drm_handle_flip_event+0x19b/0x1b0 [nvidia_drm]
Call Trace:
__nv_drm_handle_flip_event+0x19b/0x1b0 [nvidia_drm]
nv_drm_event_callback+0x83/0x90 [nvidia_drm]
nvKmsKapiHandleEventQueueChange+0xb6/0xf0 [nvidia_modeset]
_main_loop+0x8d/0x140 [nvidia_modeset]
kthread+0xfc/0x240
ret_from_fork+0x130/0x1a0
Line number in nvidia-drm-crtc.h shifts between driver versions (335 on 580.142, 322 on 595.58.03), but the assertion is identical.
Xorg SIGSEGV stack trace (from systemd-coredump)
Process Xorg killed by SIGSEGV
Stack trace:
#0 0x00000000005366e0 <inside Xorg .text>
#1 _dl_lookup_symbol_x (ld-linux-x86-64.so.2 + 0xab42)
#2 _dl_fixup (ld-linux-x86-64.so.2 + 0x111bc)
#3 _dl_runtime_resolve_xsavec (ld-linux-x86-64.so.2 + 0x136ae)
#4 wfbDestroyPixmap (libwfb.so + 0xb899)
#5 nvidia_drv.so (offset varies: +0x4dc964 on 580.142, +0x235794 on 595.58.03)
The crash is in the dynamic linker during lazy symbol resolution from wfbDestroyPixmap, which was called from nvidia_drv.so during CRTC/pixmap teardown. nvidia_drv.so offsets change between versions (code is recompiled), but the call pattern and failure mode are identical on every version tested.
Driver versions tested (all reproduce)
| Version | Source | Result |
|---|---|---|
| 580.119.02 | RPM Fusion | Crash |
| 580.126.18 | RPM Fusion | Crash |
| 580.142 | RPM Fusion updates-testing | Crash |
| 595.58.03 (open kernel modules) | negativo17 | Crash |
I was unable to test 580.95.05 because its source no longer builds against kernel 6.19.x (vm_flags read-only and in_irq() removed).
Workarounds investigated
- Kernel downgrade 6.19.x → 6.18.12 — same crash.
- Mesa downgrade 25.3.6 → 25.3.5 — same crash.
xrandr --output HDMI-1-0 --offbefore unplugging — same crash (so this is not a hotplug event race — any CRTC deactivation crashes).- Only reliable workaround: suspend the laptop before unplugging the HDMI cable. After resume the CRTC is torn down cleanly (no WARNING, no crash). This strongly suggests the bug is in the
“teardown from active state” code path specifically.
Additional observation
A few seconds before one of the crashes I observed a burst of nvidia-modeset: ERROR: GPU:0: Failed to query display engine channel state: 0x0000ca7e:… messages, hinting that the display engine channel may already be in an inconsistent state by the time the flip event handler runs.
Attached
nvidia-bug-report.log.gz — captured with 595.58.03 loaded, immediately after reproducing the crash.
Happy to provide additional diagnostics. This is a full and reproducible crash on a currently shipping Blackwell laptop, not a rare corner case.
nvidia-bug-report.log.gz (444.5 KB)