KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision	Error
2ad22663-a820-415a-8379-26f0fff671fa	assessment-security	DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (5)	2026/07/17 00:11	2026/07/17 00:11	2026/07/17 00:57	49f47391518e9cfe0cedbef0d8259b0041150b4f

assessment-security

DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌

❓

KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (5)

2026/07/17 00:11

2026/07/17 00:57

49f47391518e9cfe0cedbef0d8259b0041150b4f

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-6.1	KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer	21				3	404d	440d	0/3	auto-obsoleted due to no activity on 2025/09/22 17:26
upstream	KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (4) prio:normal media	21				255	8d19h	374d	29/29	fixed on 2026/07/15 08:27
upstream	KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (3) media	21	C			271	382d	736d	29/29	fixed on 2025/07/08 00:33
upstream	KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer media	21				1	2378d	2378d	0/29	auto-closed as invalid on 2020/05/17 19:44
linux-5.15	KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer	21				1	1191d	1191d	0/3	auto-obsoleted due to no activity on 2023/08/17 04:37
linux-6.6	KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer	21				1	29d	29d	0/2	upstream: reported on 2026/06/24 12:36
upstream	KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer (2) media	21	C	inconclusive	done	14	1270d	1782d	22/29	fixed on 2023/02/24 13:51
linux-4.19	BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2)	8	syz		error	8	1316d	1817d	0/1	upstream: reported syz repro on 2021/08/02 00:51
linux-4.14	BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2)	8				1	1650d	1650d	0/1	auto-closed as invalid on 2022/05/15 07:48
upstream	BUG: unable to handle kernel paging request in tpg_fill_plane_buffer (2) media	8				1	1200d	1196d	0/29	auto-obsoleted due to no activity on 2023/07/09 12:46

================================================================== BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_extras drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2439 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x34d9/0x4160 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2707 Write of size 1 at addr ffffc9000d33b000 by task vivid-000-vid-c/22773 CPU: 0 UID: 0 PID: 22773 Comm: vivid-000-vid-c Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 tpg_fill_plane_extras drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2439 [inline] tpg_fill_plane_buffer+0x34d9/0x4160 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2707 vivid_fillbuff+0x963/0x3ff0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 vivid_thread_vid_cap_tick+0x81b/0x1470 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629 vivid_thread_vid_cap+0x454/0xd70 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> The buggy address belongs to a vmalloc virtual mapping Memory state around the buggy address: ffffc9000d33af00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc9000d33af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc9000d33b000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc9000d33b080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc9000d33b100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ==================================================================

Crashes (4):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Assets (help?)	Manager	Title
2026/07/23 23:29	upstream	4539944e5151	4a865b71	.config	console log	report	info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream	KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/07/19 22:28	upstream	c6859eed755d	72524a66	.config	console log	report	info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream	KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/07/18 22:24	upstream	1229e2e57a5c	72524a66	.config	console log	report	info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream	KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer
2026/07/15 14:21	upstream	58717b2a1365	a4ed0f4f	.config	console log	report	info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream	KASAN: vmalloc-out-of-bounds Write in tpg_fill_plane_buffer

Crashes (4):

Assets (help?)