BUG: unable to handle kernel NULL pointer dereference in __lookup_slow

Status: upstream: reported C repro on 2026/01/03 23:57
Reported-by: syzbot+e88f99e7392dbd54eb96@syzkaller.appspotmail.com
First crash: 236d, last: 10d
▶ ▼ Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-15 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow origin:downstream 10 syz, C error 2 3d15h 132d 0/2 upstream: reported C repro on 2026/04/18 02:32
upstream BUG: unable to handle kernel NULL pointer dereference in __lookup_slow fs 10 syz, C inconclusive done 3 2020d 2160d 19/29 fixed on 2021/03/10 01:48
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow (2) 10 syz, C done 15 1842d 1965d 1/1 fixed on 2021/09/13 16:54
linux-5.15 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow origin:lts-only 10 syz, C done 5 634d 642d 0/3 auto-obsoleted due to no activity on 2025/03/12 04:53
upstream BUG: unable to handle kernel NULL pointer dereference in __lookup_slow (2) fs 10 syz, C inconclusive 4 1880d 1963d 0/29 auto-obsoleted due to no activity on 2023/04/14 10:28
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow 10 syz, C done 23 1999d 2156d 1/1 fixed on 2021/04/10 11:48
upstream BUG: unable to handle kernel NULL pointer dereference in __lookup_slow (3) overlayfs 10 syz, C inconclusive done 135 643d 852d 0/29 auto-obsoleted due to no activity on 2025/01/31 21:09
android-6-1 BUG: unable to handle kernel paging request in __lookup_slow origin:downstream 8 syz, C error 1 113d 117d 0/2 upstream: reported C repro on 2026/05/03 18:11
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/01/22 09:12 58m retest repro android13-5.10-lts report log
▶ ▼ Fix bisection attempts (6)
Created Duration User Patch Repo Result
2026/07/22 06:54 1h46m bisect fix android13-5.10-lts OK (0) job log log
2026/06/22 00:52 1h51m bisect fix android13-5.10-lts OK (0) job log log
2026/05/22 20:37 1h09m bisect fix android13-5.10-lts OK (0) job log log
2026/04/22 15:10 2h37m bisect fix android13-5.10-lts OK (0) job log log
2026/03/23 14:02 1h07m bisect fix android13-5.10-lts OK (0) job log log
2026/02/21 10:11 1h15m bisect fix android13-5.10-lts OK (0) job log log

Sample crash report:
exFAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
exFAT-fs (loop0): Medium has reported failures. Some data may be lost.
exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d)
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 0 P4D 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 298 Comm: syz-executor255 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90000b47a18 EFLAGS: 00010246
RAX: 1ffffffff0a5b7a8 RBX: 1ffff110238f7444 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88811c7ba220 RDI: ffff888121900d30
RBP: ffffc90000b47af0 R08: ffffffff86ed69f7 R09: 1ffffffff0ddad3e
R10: dffffc0000000000 R11: fffffbfff0ddad3f R12: dffffc0000000000
R13: ffff88811c7ba220 R14: ffffffff852dbd40 R15: 1ffff92000168f48
FS:  000055557a32f480(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000010ad0a000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __lookup_slow+0x2b8/0x410 fs/namei.c:1648
 lookup_one_len+0x196/0x2d0 fs/namei.c:2664
 incfs_lookup_dentry+0x60/0xb0 fs/incfs/data_mgmt.c:210
 ioctl_create_file fs/incfs/pseudo_files.c:555 [inline]
 pending_reads_dispatch_ioctl+0x1608/0x1e20 fs/incfs/pseudo_files.c:1028
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl+0x121/0x1a0 fs/ioctl.c:739
 __x64_sys_ioctl+0x7b/0x90 fs/ioctl.c:739
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f7117875c89
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc87178548 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f71178d51b9 RCX: 00007f7117875c89
RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000005
RBP: 00007f71178d5189 R08: 00007f71178d6e3d R09: 00007f71178d6e3d
R10: 00007f71178d6e3d R11: 0000000000000246 R12: 00007f71178d6e3d
R13: 00007f71178d50f1 R14: 00007f7117902bc0 R15: 0000000000000002
Modules linked in:
CR2: 0000000000000000
---[ end trace bf402c176cb3c1e6 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90000b47a18 EFLAGS: 00010246
RAX: 1ffffffff0a5b7a8 RBX: 1ffff110238f7444 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88811c7ba220 RDI: ffff888121900d30
RBP: ffffc90000b47af0 R08: ffffffff86ed69f7 R09: 1ffffffff0ddad3e
R10: dffffc0000000000 R11: fffffbfff0ddad3f R12: dffffc0000000000
R13: ffff88811c7ba220 R14: ffffffff852dbd40 R15: 1ffff92000168f48
FS:  000055557a32f480(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000010ad0a000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/18 01:46 android13-5.10-lts e334a66065d3 1e72964b .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-android-5-10 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
2026/01/03 23:56 android13-5.10-lts e253c52bbdfc d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (clean fs)] ci2-android-5-10 BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
* Struck through repros no longer work on HEAD.