Ubuntu Touch 20.04 OTA-11 is released. Thank you everyone for testing.

https://ubports.com/blog/ubports-news-1/ubuntu-touch-24-04-1-1-and-20-04-ota-11-release-3984

Ubuntu Touch 24.04-1.1 is released. Thank you everyone for testing.

https://ubports.com/blog/ubports-news-1/ubuntu-touch-24-04-1-1-and-20-04-ota-11-release-3984

Vulnerability

During the periodic scanning of the local media, gst-hybris gets loaded by Gstreamer, a media framework, to perform HW-accelerated video decoding. gst-hybris expected the rendering element ("sink") to be HW-accelerated as well, but media scanning does not use HW-accelerated rendering. This results in memory corruption, which could potentially be exploited by a specifically-crafted media.

Info

The pipeline constructing process of Gstreamer is dynamic; it can automatically pick the demuxer, decoder(s), and sink(s) based on the file type, file content, and component's capability. In this case, Gstreamer picks gst-hybris' HW-accelerated decoder as the decoder, but "fakesink" as the sink (as the scanner only wants to know certain metadata).

Now, to perform HW-accelerated video rendering, gst-hybris has a dedicated sink which co-operate with the decoder in order to pass decoded video frame without copying the memory. When Gstreamer connects the decoder with the sink, the decoder can access the sink to perform necessary co-ordination. However, the decoder forgot to check if the sink it accesses is the one it can co-operate, which results in the code writing into the memory it's not supposed to access.

In order for this to be exploited, the video has to be on the device, which subsequently leads to it being scanned. Video playback in other cases is not affected, as they always use HW-accelerated video rendering.

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

Severity: Medium

Affected versions

• Affected versions: All Ubuntu Touch versions up to and including 20.04 OTA-10, 24.04-1.0.
• Fixed in versions: Ubuntu Touch 20.04 OTA-11 and 24.04-1.1.

Solution

Starting in Ubuntu Touch 20.04 OTA-11 and 24.04-1.1, gst-hybris checks the type of the sink before casting to the expected type.

• Fixed in: https://gitlab.com/ubports/development/core/hybris-support/gst-hybris/-/commit/58bb0e1ba2169bd85ac0930bf074ab865553356f

Recommendations

• Update your device to Ubuntu Touch 20.04 OTA-11, 24.04-1.1 or newer.
• Do not download videos from untrusted sources.

Timeline

The issue was discovered on 30 September 2025, during a debugging of another issue.

The issue was discovered before the release of Ubuntu Touch 24.04-1.0, but we did not manage to work it through and fix it in time for that release.

Ubuntu Touch 20.04 OTA-11 and 24.04-1.1 was released on 1 December 2025, coordinated with the publication of this advisory.

Credit

• Reported-by: Ratchanan Srirattanamet
• Patched-by: Ratchanan Sirrattanamet

@gandalf said in Call for testing: Ubuntu Touch 20.04 OTA-11:

After some more testing it seems that VoLTE is not working properly on my FP4. It shows up in the settings and status indicator but as soon as I make a call it drops back to 3G.

Is VoLTE officially part of this ota?

VoLTE on Fairphone 4 has been enabled at port level and should be available starting from Ubuntu Touch 24.04-1.1 and 20.04 OTA-11. That said, we're aware that our VoLTE code is not fully stable. This is something we'll work on in the future.

Update 26 November 2025: The release of Ubuntu Touch 24.04-1.1 and 20.04 OTA-11 has been delayed due to my personal situation (there has been flooding in my area). Now that the situation has improved, I'll now work on finalizing the release of both versions and get the update to the stable channels as soon as possible.

Update 26 November 2025: The release of Ubuntu Touch 24.04-1.1 and 20.04 OTA-11 has been delayed due to my personal situation (there has been flooding in my area). Now that the situation has improved, I'll now work on finalizing the release of both versions and get the update to the stable channels as soon as possible.

Update 18 November 2025 (2): Apologize for the mistake. We've published Ubuntu Touch 20.04 OTA-11 RC 2 to include a fix for sending SMS on some VoLTE-enabled devices.. The release date for Ubuntu Touch 20.04 OTA-11 is still 25 November 2025.

Update 18 November 2025: we're postponing the release of Ubuntu Touch 20.04 OTA-11 to 25 November 2025 to coincide with the release of Ubuntu Touch 24.04-1.1. This is due to a security fix which has to be released at the same time. We're sorry for your inconvenience.

Update 18 November 2025

• Ubuntu Touch 24.04-1.1 RC 2 is now available for testing. This release fixes:
  • Issues with voice calls on Volla Phone 22.
  • Crash in Messaging app when attempting to play an attached video or audio.
  • Sending SMS on some VoLTE-enabled devices.

The new release date for Ubuntu Touch 24.04-1.1 is 25 November 2025.

• Due to a migration in Volla Phone 22's hardware abstraction layer (HAL), after receiving Ubuntu Touch 24.04-1.1 RC 1 or later (including daily channel), you will be unable to switch back to Ubuntu Touch 24.04-1.0 using UI. Please follow this instruction to use UBports Installer to re-install Ubuntu Touch 24.04-1.0.

• It is known that Sony Xperia X doesn't boot Ubuntu Touch 24.04-1.x images. This has been known since before 24.04-1.0 release, but due to administrative mistake, the list of device on our release announcement was not updated. The release announcement blog has since been updated. Due to its age, we're unable to guarantee if we'll be able to restore support for Sony Xperia X within 24.04-1.x releases or not. We're sorry for your inconvenience.

@Charly said in Call for testing: Ubuntu Touch 24.04-1.1:

Hello forum,

Since 24.04-1.1 rc1 I noticed that my micro SD card is read only mounted. I use a Volla X23.

Is this issue known?

I'm unable to reproduce this issue. There's actually a number of reasons a storage could be mounted read-only; could you please try switching back to 24.04-1.x Stable channel and see if the issue goes away?

@Carlos said in Call for testing: Ubuntu Touch 24.04-1.1:

This weekend I updated my Vollaphone22 from 24.04-1.0 to 24.04-1.1 and screen starts blinking on boot before the logo Ubuntu appears.
With installer reinstalled 24.04-1.1 without wiping data and everything I use every day starts working normally until I found a serious bug on calls.
Yesterday a friend calls me, I answered the call but no sound from other side. My friend repeated calling me and all answering was no sound.
With other phone at hand I search the source of the error and found the Vollaphone22 was the culprit.
How to reproduce is like this, make a call to other phone, wait that the other side answer the call, talk to test that audio is ok, wait that the other phone hang the call, now if you repeat process there is no sound if answered the call. Only rebooting Vollaphone works again, untill other phone terminates the call first and error returns.
This error does not happens on version 20.04 stable.

Thank you for the report. We're looking into this issue and will delay Ubuntu Touch 24.04-1.1 until we have this issue figure out.

@mjosenhans said in Call for testing: Ubuntu Touch 24.04-1.1:

I yesterday installed on my volla phone 22 Ubport 24.04-1.1 RC1 via RC channel. I had problems with incoming and outgoing voice calls without any voice being heard in both directions. Thus I reinstalled 24.04-1.x stable via stable channel. However instead of running the again the 24.04.1 software from stable, the phone is now in a reset loop. It shows the volla screen, then a black screen via backlight on, then a black screen with backling off and then again the volla screen. And so on.

When going into boot loader, I was able to start the recovery mode, however it did not change, it is still in boot loop. Ubports installer is not finding the phone too. What can I do? I plan tomorrow to go to the phone service shop in berlin, which provides volla service and try to reflash the phone.

We're sorry that this happen. Please try the following:

1. Boot to bootloader by pressing Volume Up + Power (or Volume Up + plugging cable), then select "Enter fastboot menu". Do not enter recovery.
2. Starts UBports Installer, then manually select "Volla Phone 22" (the Installer currently cannot auto-detect device model in bootloader mode).
3. Select "24.04-1.x Stable" channel and ensure "Bootstrap" option is checked. Leave "Wipe Userdata" unchecked.
4. Follow further instructions from the Installer.

@gpatel-fr said in Call for testing: Ubuntu Touch 24.04-1.1:

@peat_psuwit said in Call for testing: Ubuntu Touch 24.04-1.1:

send file journal.log?

attached.
Note that I know why there are deny messages for ntp servers. It's the firewall on my installation (not ufw - a site firewall) blocking ntp for devices on wifi (these devices can only ping and https/https)
journal.log

Thank you for the log. While it gives me some information, unfortunately this log does not show the issue being reproduced. I'm going to include some changes in 24.04-1.2 which should makes this happen less often, but I won't be able to guarantee that it actually fixes the issue.

Since you mentioned NTP being blocked on your local network, it's probably worth mentioning that we currently don't use date & time given by cellular towers; the only way we can automatically set date & time is through NTP over either Wi-Fi or mobile data. Although in your case, I suspect that systemd-timesyncd (NTP client) doesn't react well with changing network conditions, which is why disabling and re-enabling mobile data doesn't help.

@adorsaz said in Call for testing: Ubuntu Touch 24.04-1.1:

On a Fairphone 4, I've migrated from daily build (19th October) to this RC, I confirm I am still able to use VoLTE to make a call.

Although I cannot send SMS to recipient with phone number formated with my country prefix (+41).
I share log here with redacted recipient phone number:

sms_send.log

Edit: during the day I was able to receive VoLTE call and receive SMS.

We're going to land a change that could help with this in tomorrow's 24.04-1.x daily image. If possible, please switch to 24.04-1.x daily channel and see if you can now send an SMS. If this is successful, we're going to have another RC image.

@lk108 said in Call for testing: Ubuntu Touch 24.04-1.1:

In xenial and focal, the clearPersistent DBus method of com.Lomiri.Postal required the appid and the tag as a string. In 24.04-1.0, the tag(s) had to be passed as array of strings. Is it correct that this has been reverted and tags are passed as strings instead of an array of strings to clearPersistent?

That's sort-of correct. The change is "reverted" - more accurately, we made it so that the change seems to be reverted for applications which clear 1 tag at a time (which most applications do).

The full story is: originally, clearPersistent accepted not an appid and a tag, but an appid followed by an arbitrary amount of tags. Yes, for some reason, Canonical made the original clearPersistent accepts, for lack of better terms, "variadic arguments".

But this is very unusual in the DBus ecosystem. When we first migrated lomiri-push-service, a Go code, to the new DBus library (godbus/dbus), we didn't notice this weird pattern and assumed that the function accepted a list. Once we noticed this, we attempted to restore it, only to discover that it's not simple to support "variadic arguments" using godbus/dbus.

So we've decided on a compromise: we've discovered that, outside of our own code, most callers of clearPersistent pass only 1 tag to it. So, starting with 24.04-1.1, clearPersistent accepts exactly 1 appid and 1 tag, which should unbreak most unmodified applications. For those that actually pass multiple tags to clearPersistent, we now have clearPersistentList which accepts an appid followed by an array of tags.

"Technically", this DBus API is private and applications are supposed to use Lomiri.PushNotifications QML type. In practice, there are applications which need to call this DBus API from C++ or Rust. So we want to maintain compatibility where it makes sense.

This MR summarize the state of both functions in various versions of Ubuntu Touch, and also serves as an example on how one can support multiple versions of DBus methods.

Side note: I see in DeltaTouch codebase that you call QSysInfo::productVersion(). Please note that this function (currently) returns the version of the underlying Ubuntu version and not necessarily the version of Ubuntu Touch. With the new release scheme, we could have multiple Ubuntu Touch (major) versions be based on the same Ubuntu version. Please use other kinds of detections (such as what we outlined in the MR) instead.

@gpatel-fr said in Call for testing: Ubuntu Touch 24.04-1.1:

@peat_psuwit

Switched from 24.04.1 daily to RC on my newly installed FP5
Noticed 3 details:

1. the noise generated by keys, for example on unlocking the screen. Fixed it by going to settings and unsetting the option. Either the updated enabled the sound (and it's a bug) or the sound was enabled and it was not generated (in this case a bug was fixed)

Could you please elaborate on "noise" and "keys"?

2. no more hour from the network so I'm back in 1970. Tried to reboot, switched off and on the cellular data, no change

3. no more Store

I think that 3) comes from 2) in fact (the certificates for all sites are not yet valid)

There's some intricate interactions in the way clocks are managed on Qualcomm devices such as FP5. Could you please collect logs using the following command and send file journal.log?

sudo journalctl --boot \
    --identifier=systemd \
    --identifier=timekeeper \
    --identifier=systemd-timesyncd \
    >journal.log

@gpatel-fr said in Call for testing: Ubuntu Touch 24.04-1.1:

@peat_psuwit

automatic screen rotation does not work for me with RC (FP5)

In fairness, I have spent only 2 days with 24.04 stable and one day with 24.04 daily so I can't be 100% sure that rotation worked with daily. However I'm sure that it was working at least with stable.
I think that it was working with daily because it's something one notice very fast normally. And yes the setting 'rotation lock' is disabled and enabling/disabling it did not restore automatic screen rotation.

I did not look carefully in the sensor app at the gyroscope output so I'm not sure if something is wrong here - the changes are happening so fast that it's almost impossible to evaluate.

I cannot reproduce this on my FP5.

That said, it's weird that you start having these problems after switching from Daily channel to RC channel. Images in the RC channel are actually images from Daily channel being copied to RC channel. So I have no idea why that happens...

@adorsaz said in Call for testing: Ubuntu Touch 24.04-1.1:

On a Fairphone 4, I've migrated from daily build (19th October) to this RC, I confirm I am still able to use VoLTE to make a call.

Although I cannot send SMS to recipient with phone number formated with my country prefix (+41).
I share log here with redacted recipient phone number:

sms_send.log

Edit: during the day I was able to receive VoLTE call and receive SMS.

There are some changes in how we send SMS over VoLTE recent. It's possible that this is the cause.

CC: @mariogrip -- the log seems to indicate that QCom-side IMS service wants a "fallback"?

@lazarus said in Call for testing: Ubuntu Touch 24.04-1.1:

@peat_psuwit Tried to install the 24.04-1.x channel release on my Sony Xperia X using the UBports installer. Installing was completed, but after reboot the device hangs at the white "Sony" screen for multiple minutes and won't boot any further.

Staying connected to the PC I can see the network connection established via USB, but I can't connect to 10.15.19.82 using ssh.

It's known that Sony Xperia X doesn't boot 24.04-1.x images. We're still investigating this issue. This is the reason we don't publish a stable image for Sony Xperia X yet.

I think I myself forgot to put it into the latest previous announcement... yeah, sorry about that. We'll fix the announcement.

@lduboeuf said in Call for testing: Ubuntu Touch 24.04-1.1:

@peat_psuwit
I think an update of Telegram is needed for the notifications list not cleared fix

The Teleports update should not be needed for this to be fixed, at least in the specific case of Teleports.

Update 26 November 2025: The release of Ubuntu Touch 24.04-1.1 and 20.04 OTA-11 has been delayed due to my personal situation (there has been flooding in my area). Now that the situation has improved, I'll now work on finalizing the release of both versions and get the update to the stable channels as soon as possible.

---

We've just released the RC image for the Ubuntu Touch 20.04 OTA-11. Please take some time to switch your spare/development phone to the 20.04 RC channel and test this OTA.

Ubuntu Touch 20.04 OTA-11 is a maintenance release of 20.04 series. This release contains mostly bug fixes and small improvements. The notable ones are:

• USB-C headset support is now also enabled on 20.04 series as well.
• Fix audio playback not automatically stopped when a Bluetooth headset is disconnected.

Please note that only critical and security fixes will be able to enter Ubuntu Touch 20.04 OTA-11 as this point. Normal bug fixes and new features will need to wait for our next release. Please do not discuss normal bug fixes and new features here.

Ubuntu Touch 20.04 OTA-11 is expected to be released on 13 November 2025. We appreciate all testing we will receive.

---

At the same time, we've also released the RC image for Ubuntu Touch 24.04-1.1. We have a dedicated forum post. Note: please refrain from discussing Ubuntu Touch 24.04-1.1 in this post.

Update 26 November 2025: The release of Ubuntu Touch 24.04-1.1 and 20.04 OTA-11 has been delayed due to my personal situation (there has been flooding in my area). Now that the situation has improved, I'll now work on finalizing the release of both versions and get the update to the stable channels as soon as possible.

---

We've just released the RC image for Ubuntu Touch 24.04-1.1. Please take some time to switch your spare/development phone to the 24.04-1.x RC channel and test this update.

Ubuntu Touch 24.04-1.1 is a maintenance release of 24.04-1.x series. This release contains mostly bug fixes and small improvements. The notable ones are:

• Improved startup time on first boot after upgrading from Ubuntu Touch 20.04 series.
• Fix media scanning daemon getting stuck at 100% CPU usage, draining battery.
• Fix notification badges not appearing in the launcher for Phone and Messaging app.
• Fix applications e.g. TELEports unable to clear notifications before placing a new one.
• Fix incorrect calendar being shown in the pull-down (indicator) menu.
• Fix certain applications using embedded web browser crashing after attempting to use the browser.
• Fix Wi-Fi hotspot being broken on certain devices.
• Prevents deleted Wi-Fi or VPN connection re-appearing after reboot.
• General bug fixes and security updates.

To receive Ubuntu Touch 24.04-1.1 on a device running Ubuntu Touch 24.04-1.0, heads to System Settings -> Updates -> Update Settings -> Release Channel, then select "24.04-1.x Release candidate". Go back to the previous page, and then install the available update.

If your phone is running Ubuntu Touch 20.04 OTA-10, you can receive Ubuntu Touch 24.04-1.1 by first following the instructions above (but select "20.04 Release candidate" instead), then go to System Settings > Update again to upgrade to 24.04-1.1 RC.

Please note that only critical and security fixes will be able to enter Ubuntu Touch 24.04-1.1 as this point. Normal bug fixes and new features will need to wait for our next release. Please do not discuss normal bug fixes and new features here.

Ubuntu Touch 24.04-1.1 is expected to be released on 13 November 2025. We appreciate all testing we will receive.

---

At the same time, we've also released the RC image for Ubuntu Touch 20.04 OTA-11. We have a dedicated forum post. Note: please refrain from discussing Ubuntu Touch 20.04 OTA-11 in this post.

Update 30 September 2025: after debugging, we've decided that it's likely that the report where some devices fail to boot after installing Ubuntu Touch 24.04-1.0 RC 2 is likely a false positive. As such, it's been decided to go ahead with the release of 24.04-1.0.

Which means that Ubuntu Touch 24.04-1.0 is now released.

https://ubports.com/blog/ubports-news-1/ubuntu-touch-24-04-1-0-release-3973

Thank you for everyone involved in testing.

Update 25 September 2025: we've had a report where some devices fail to boot after installing Ubuntu Touch 24.04-1.0 RC 2, which requires us to delay the release of Ubuntu Touch 24.04-1.0. We're looking into it and will provide update as soon as possible.

Ubuntu Touch 20.04 OTA-10 is released! Thank you everyone involved in testing.

https://ubports.com/blog/ubports-news-1/ubuntu-touch-20-04-ota-10-release-3972

@Vlad-Nirky said in Call for testing: Ubuntu Touch 24.04-1.0:

@peat_psuwit
Hello.
I took some photos with my Xiaomi Redmi Note 9 Pro running UT 24.04-1.0 RC 1 during a few days of holiday.
The indoor photos are fine, but those taken outside are overexposed.
I restarted the phone, but that didn't change anything.

The image quality of the device largely depends on the hardware-specific code from device manufacturer; we don't have much control over it. As such, I would suggest you to ask your port's maintainers to take a closer look into this.

@lduboeuf said in Call for testing: Ubuntu Touch 24.04-1.0:

First impressions:
<...>
Telegram Notifications are nor overriden ( list is always growing)
<...>

You're saying that anewer notification from the same contact should replace the old one, but doesn't? That's probably lomiri-push-service as we have a big refactor there to migrate to a different DBus library. If you can turn this into a GitLab issue I would appreciate it. Otherwise I can do it too.