Here's how it goes: 1. stdin reaches EOF, kmscon_eloop_rm_fd is called on stdin_fd. 2. The fd object is freed, the memory is reused in the meantime. 3. rm_fd is called again in destroy_eloop. 4. con->stdin_fd points to garbage and we get a segmentation fault. Signed-off-by: Ran Benita <ran234@gmail.com> Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>