osqueryd: Program terminated with signal SIGSEGV, Segmentation fault.
Author: taslesonCreated Oct 2, 2025Updated Sep 22, 2026
LabelsbugLinuxtriage
Bug report
What operating system and version are you using?
Fedora 42
What version of osquery are you using?
https://github.com/osquery/osquery/releases/download/5.19.0/osquery-5.19.0-1.linux.x86_64.rpm and https://github.com/osquery/osquery/releases/download/5.19.0/osquery-debuginfo-5.19.0-1.linux.x86_64.rpm
to collect a back trace
What steps did you take to reproduce the issue?
Just let osqueryd run
What did you expect to see?
No Program terminated with signal SIGSEGV, Segmentation fault. and associated core dumps
What did you see instead?
Program terminated with signal SIGSEGV, Segmentation fault. and core dumps
...
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/opt/osquery/bin/osqueryd '' '' '' '''.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >::__is_long (
this=0x17ffffffe8) at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/string:1426
warning: 1426 /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/string: No such file or directory
[Current thread is 1 (Thread 0x7f859d9ea6c0 (LWP 1249667))]
(gdb) bt
#0 std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >::__is_long (
this=0x17ffffffe8) at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/string:1426
#1 std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >::size (this=0x17ffffffe8)
at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/string:953
#2 std::__1::operator==<char, std::__1::char_traits<char>, std::__1::allocator<char> > (__lhs=...,
__rhs=0x564e7efa157a "*") at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/string:3894
#3 0x0000564e8072d039 in osquery::patternedPath::Compare::operator() (this=<optimized out>, lhs=..., rhs=...)
at /usr/src/debug/osquery/src_1/ns_osquery_events/osquery/events/pathset.h:111
#4 0x0000564e8072da09 in std::__1::__tree<std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > >, osquery::patternedPath::Compare, std::__1::allocator<std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > > >::__lower_bound<std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > > (this=<optimized out>, __v=..., __root=0x564e9effc4d0,
__result=0x564e9ea10750) at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/__tree:2654
#5 0x0000564e8072d987 in std::__1::__tree<std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > >, osquery::patternedPath::Compare, std::__1::allocator<std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > > >::find<std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > > (this=0x564e9ea10748, __v=...)
at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/__tree:2574
#6 0x0000564e8072a6d5 in std::__1::multiset<std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > >, osquery::patternedPath::Compare, std::__1::allocator<std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > > >::find (this=0x564e9ea10748, __k=...)
at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/set:1296
#7 osquery::PathSet<osquery::patternedPath>::find (this=0x564e9ea10748, str=...)
at /usr/src/debug/osquery/src_1/ns_osquery_events/osquery/events/pathset.h:59
#8 0x0000564e8072a5e1 in osquery::INotifyEventPublisher::shouldFire (this=<optimized out>, sc=..., ec=...)
at /__w/osquery/osquery/workspace/padding-required-by-rpm-packages/src/osquery/events/linux/inotify.cpp:354
#9 0x0000564e8072aebf in osquery::EventPublisher<osquery::INotifySubscriptionContext, osquery::INotifyEventContext>::fireCallback (this=0x564e7efa157a, sub=..., ec=...)
at /usr/src/debug/osquery/src_1/ns_osquery_events_eventsregistry/osquery/events/eventpublisher.h:107
#10 0x0000564e806676ff in osquery::EventPublisherPlugin::fire (this=0x564e9ea10508, ec=..., time=<optimized out>)
at /__w/osquery/osquery/workspace/padding-required-by-rpm-packages/src/osquery/events/eventpublisherplugin.cpp:82
#11 0x0000564e8072a0d3 in osquery::INotifyEventPublisher::run (this=0x564e9ea10508)
at /__w/osquery/osquery/workspace/padding-required-by-rpm-packages/src/osquery/events/linux/inotify.cpp:287
#12 0x0000564e8066b1f2 in osquery::EventFactory::run (type_id=...)
at /__w/osquery/osquery/workspace/padding-required-by-rpm-packages/src/osquery/events/eventfactory.cpp:397
#13 0x0000564e8066cf5e in std::__1::__invoke<osquery::Status (*&)(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&), std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >&> (__f=<error reading variable: Cannot access memory at address 0x9>, __args=...)
at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/type_traits:3530
#14 std::__1::__apply_functor<osquery::Status (*)(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&), std::__1::tuple<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, 0ul, std::__1::tuple<> >(osquery::Status (*&)(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&), std::__1::tuple<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >&, std::__1::__tuple_indices<0ul>, std::__1::tuple<>&&) (
__f=<error reading variable: Cannot access memory at address 0x9>, __bound_args=..., __args=...)
at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/functional:2716
#15 std::__1::__bind<osquery::Status (*)(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&), std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&>::operator()<>() (this=0x9) at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/functional:2749
#16 std::__1::__invoke<std::__1::__bind<osquery::Status (*)(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&), std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&>>(std::__1::__bind<osquery::Status (*)(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&), std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&>&&) (__f=...) at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/type_traits:3530
#17 std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, std::__1::__bind<osquery::Status (*)(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&), std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const--T--T--Type <RET>--Type <RET> for more--Type <RET> for more, q to quit, c --Type <RET> for more, q--Type <RET> for m--Type <RET>--Type--T--Type <RET> for more, q to--Type <RET> for more--Type <RET> for m--Type <RET> for more--Type <RET> fo--Type <RET> for m--Type <RET> for m--Type <RET> for m--Type <RET> for m--Type <R--Type--Type--T--T--T--T--T--T--T--T--Type <RET> for more, q to quit, c to continue without paging--c
&>>(std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, std::__1::__bind<osquery::Status (*)(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&), std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&>>&, std::__1::__tuple_indices<>) (__t=...) at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/thread:277
#18 0x0000564e8066ce3e in std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, std::__1::__bind<osquery::Status (*)(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&), std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&> > > (__vp=<optimized out>)
at /usr/local/osquery-toolchain/usr/bin/../include/c++/v1/thread:287
#19 0x00007f85a100ef54 in start_thread (arg=<optimized out>) at pthread_create.c:448
#20 0x00007f85a109232c in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
(gdb) Source: osquery/osquery