KASAN: use-after-free Write in pppol2tp_release

Status: upstream: reported C repro on 2026/06/22 20:31
Reported-by: syzbot+bf28d148b4d82ae2e3da@syzkaller.appspotmail.com
First crash: 145d, last: 43m
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-6-1 KASAN: use-after-free Write in pppol2tp_release origin:upstream missing-backport 22 syz, C 3289 now 157d 0/2 upstream: reported C repro on 2026/06/11 04:50
android-5-15 KASAN: use-after-free Write in pppol2tp_release origin:upstream missing-backport 22 syz, C 3110 24m 146d 0/2 upstream: reported C repro on 2026/06/22 15:45
android-49 KASAN: use-after-free Read in pppol2tp_release 19 syz, C 6 3030d 2772d 0/3 public: reported C repro on 2019/04/14 00:00
android-44 KASAN: use-after-free Read in pppol2tp_release 19 5 3022d 3219d 0/2 auto-closed as invalid on 2019/02/22 14:09

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
Write of size 8 at addr ffff88810feba950 by task syz.2.17/399

CPU: 1 PID: 399 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
 atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
 __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
 mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 exit_task_work include/linux/task_work.h:33 [inline]
 do_exit+0xa7c/0x24e0 kernel/exit.c:879
 do_group_exit+0x149/0x310 kernel/exit.c:993
 get_signal+0xfb1/0x1300 kernel/signal.c:2806
 arch_do_signal_or_restart+0xe7/0x11b0 arch/x86/kernel/signal.c:805
 handle_signal_work kernel/entry/common.c:148 [inline]
 exit_to_user_mode_loop+0xa2/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:202
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:277
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f41ee350657
Code: Unable to access opcode bytes at RIP 0x7f41ee35062d.
RSP: 002b:00007ffe4285ebe0 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6
RAX: fffffffffffffdfc RBX: 000055557f364500 RCX: 00007f41ee350657
RDX: 00007ffe4285ec20 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007f41ee42404e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007f41e

Crashes (5543):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/11/13 19:11 android13-5.10-lts c73351b2e985 be5d1971 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/13 14:09 android13-5.10-lts c73351b2e985 be5d1971 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/08 02:54 android13-5.10-lts f61a392235e0 5cecaf1f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/05 18:19 android13-5.10-lts f61a392235e0 2ee8459f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/01 21:43 android13-5.10-lts f61a392235e0 25a0ae84 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/01 20:43 android13-5.10-lts f61a392235e0 25a0ae84 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/10/31 10:02 android13-5.10-lts f61a392235e0 2041d3f8 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/10/23 03:51 android13-5.10-lts d3231d350eb8 b55fad29 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/10/17 12:18 android13-5.10-lts 30b93835619a 432c0077 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/10/11 06:01 android13-5.10-lts b677692288f7 4f92358f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/10/11 00:04 android13-5.10-lts b677692288f7 4f92358f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/10/09 13:23 android13-5.10-lts b677692288f7 b2734a59 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/10/08 23:11 android13-5.10-lts b677692288f7 b2734a59 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/10/06 09:06 android13-5.10-lts 207de56dd089 f7710056 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/10/05 04:22 android13-5.10-lts 42d4fb705937 57bbd979 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/10/03 13:06 android13-5.10-lts 8ddf8d57c49c 57bbd979 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/27 11:16 android13-5.10-lts c5d8ec7afea2 a3c7249d .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/26 20:09 android13-5.10-lts c5d8ec7afea2 a3c7249d .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/24 09:06 android13-5.10-lts 452567d1985b 0281b448 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/24 07:31 android13-5.10-lts 452567d1985b 0281b448 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/22 02:24 android13-5.10-lts 452567d1985b 853b104b .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/20 23:57 android13-5.10-lts 452567d1985b 853b104b .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/19 18:47 android13-5.10-lts 452567d1985b 853b104b .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/19 14:44 android13-5.10-lts 452567d1985b 853b104b .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/19 10:04 android13-5.10-lts 452567d1985b 853b104b .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/18 21:47 android13-5.10-lts 452567d1985b 853b104b .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/14 04:56 android13-5.10-lts 452567d1985b 70a60e12 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/13 10:34 android13-5.10-lts 452567d1985b 70a60e12 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/13 02:07 android13-5.10-lts 452567d1985b 70a60e12 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/11 23:30 android13-5.10-lts 452567d1985b b6a5eeb7 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/09 14:31 android13-5.10-lts 452567d1985b 8387c273 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/08 05:17 android13-5.10-lts 452567d1985b 680aa3e1 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/06/22 20:27 android13-5.10-lts 72aefab72b3d 5a630be6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/08 23:46 android13-5.10-lts f61a392235e0 5cecaf1f .config strace log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/07 08:35 android13-5.10-lts f61a392235e0 5cecaf1f .config strace log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/10/31 03:57 android13-5.10-lts f61a392235e0 0ec395f8 .config strace log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/10/02 00:49 android13-5.10-lts 27ea5541934c f5cdae2f .config strace log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/29 13:36 android13-5.10-lts 340d402887d3 7bf4ea23 .config strace log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/22 02:56 android13-5.10-lts 452567d1985b 853b104b .config strace log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/16 18:14 android13-5.10-lts 452567d1985b 12a0a44a .config strace log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/09/15 23:13 android13-5.10-lts 452567d1985b 2daa4bb5 .config strace log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/06/22 20:24 android13-5.10-lts 72aefab72b3d 5a630be6 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 15:19 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 13:20 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 12:19 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 10:37 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 09:35 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 07:50 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 06:46 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 06:10 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 05:09 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 04:08 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 02:45 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 01:32 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/15 00:03 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/14 19:40 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/14 18:29 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/14 16:36 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/14 14:52 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/14 12:15 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/14 11:12 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/14 09:40 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/14 08:53 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/14 06:57 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/14 05:20 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/14 03:59 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/14 02:06 android13-5.10-lts c73351b2e985 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/13 20:30 android13-5.10-lts c73351b2e985 be5d1971 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/13 19:29 android13-5.10-lts c73351b2e985 be5d1971 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/13 17:41 android13-5.10-lts c73351b2e985 be5d1971 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/13 15:32 android13-5.10-lts c73351b2e985 be5d1971 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/13 05:15 android13-5.10-lts c73351b2e985 c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/13 04:01 android13-5.10-lts c73351b2e985 c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/13 02:39 android13-5.10-lts c73351b2e985 c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/13 01:07 android13-5.10-lts c73351b2e985 c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/12 23:55 android13-5.10-lts c73351b2e985 c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/12 23:47 android13-5.10-lts c73351b2e985 c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/12 19:50 android13-5.10-lts c73351b2e985 c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/12 18:35 android13-5.10-lts c73351b2e985 c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/12 13:02 android13-5.10-lts c73351b2e985 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/12 11:51 android13-5.10-lts c73351b2e985 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/12 10:38 android13-5.10-lts c73351b2e985 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/12 06:47 android13-5.10-lts c73351b2e985 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/12 05:37 android13-5.10-lts c73351b2e985 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in pppol2tp_release
2026/11/12 14:02 android13-5.10-lts c73351b2e985 8d68b303 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Read in pppol2tp_release
2026/08/16 08:48 android13-5.10-lts e334a66065d3 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KFENCE: use-after-free write in pppol2tp_release
* Struck through repros no longer work on HEAD.