BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport (2)

Status: upstream: reported C repro on 2026/09/08 22:08
Subsystems: usb-storage
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+356ae236154297f0d60d@syzkaller.appspotmail.com
First crash: 9h44m, last: 3h01m
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
0f326139 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport (2) 2026/09/09 00:54 2026/09/09 00:54 2026/09/09 01:43 243b72f1
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [usb-storage?] BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport (2) 0 (1) 2026/09/08 22:08
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport usb-storage 10 1 419d 415d 0/29 auto-obsoleted due to no activity on 2025/10/14 16:40

Sample crash report:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 800000006f80d067 P4D 800000006f80d067 PUD 6f9b7067 PMD 0 
Oops: Oops: 0010 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 5647 Comm: usb-storage Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90003c3faf8 EFLAGS: 00010246
RAX: 1ffff1100fe1f9f0 RBX: ffff888072e03110 RCX: ffffffff9a9de501
RDX: 0000000000000001 RSI: ffffffff8e474d50 RDI: ffff88807f0fce90
RBP: ffffc90003c3fcd0 R08: ffffffff907a1e7f R09: 1ffffffff20f43cf
R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff1100fe1f80e
R13: 1ffff92000787f74 R14: ffff88807f0fce90 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff888124cd6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000071e6c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 usb_stor_invoke_transport+0x55a/0x1a40 drivers/usb/storage/transport.c:926
 usb_stor_control_thread+0x44c/0x8f0 drivers/usb/storage/usb.c:462
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90003c3faf8 EFLAGS: 00010246
RAX: 1ffff1100fe1f9f0 RBX: ffff888072e03110 RCX: ffffffff9a9de501
RDX: 0000000000000001 RSI: ffffffff8e474d50 RDI: ffff88807f0fce90
RBP: ffffc90003c3fcd0 R08: ffffffff907a1e7f R09: 1ffffffff20f43cf
R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff1100fe1f80e
R13: 1ffff92000787f74 R14: ffff88807f0fce90 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff888124cd6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000071e6c000 CR4: 00000000003526f0

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/08 22:55 upstream 28924df2a08f 243b72f1 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
2026/09/08 21:18 upstream 28924df2a08f 243b72f1 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
2026/09/08 19:37 upstream 28924df2a08f 243b72f1 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
2026/09/08 17:56 upstream 28924df2a08f 243b72f1 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
2026/09/08 16:12 upstream 28924df2a08f 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
* Struck through repros no longer work on HEAD.