general protection fault in br_del_frame

Status: upstream: reported syz repro on 2026/09/04 00:40
Subsystems: bridge
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+1df7473ef265fe8ba6e1@syzkaller.appspotmail.com
First crash: 31d, last: 13m
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
9e52d9c5 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ general protection fault in br_del_frame 2026/08/09 22:09 2026/08/09 22:09 2026/08/09 22:43 5d63f80b
70b60d9f assessment-security 💥 general protection fault in br_del_frame 2026/08/05 00:08 2026/08/05 00:08 2026/08/05 00:08 d4abbeac
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH net] net: bridge: dynamically allocate frame_type instances for CFM and MRP 3 (3) 2026/09/04 06:13
[syzbot] [bridge?] general protection fault in br_del_frame 0 (1) 2026/09/04 00:40
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.6 general protection fault in br_del_frame 2 3 6d09h 10d 0/2 upstream: reported on 2026/08/25 05:29
linux-6.1 BUG: unable to handle kernel paging request in br_del_frame origin:lts-only 8 syz 4 1d13h 22d 0/3 upstream: reported syz repro on 2026/08/12 17:14
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/09/04 00:06 20m edumazet@google.com patch upstream OK job log log
2026/09/03 23:33 20m edumazet@google.com patch upstream OK job log log

Sample crash report:
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127]
CPU: 1 UID: 0 PID: 12 Comm: kworker/u32:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:__hlist_del include/linux/list.h:1038 [inline]
RIP: 0010:hlist_del_rcu include/linux/rculist.h:599 [inline]
RIP: 0010:br_del_frame+0x106/0x1a0 net/bridge/br_input.c:482
Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 87 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 65 18 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 76 49 89 1c 24 48 85 db 74 24 e8 c6 45 72 f7 48 8d
RSP: 0018:ffffc900000f78e8 EFLAGS: 00010a06
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 1bd5a00000000024 RSI: ffffffff8a98bb9f RDI: ffffffff91453338
RBP: ffffffff91453320 R08: 0000000000000001 R09: 000000000000002c
R10: 0000000000000200 R11: 0000000000000001 R12: dead000000000122
R13: ffff88802e200800 R14: 000000000000001c R15: ffff88802e200800
FS:  0000000000000000(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdcf9541e9c CR3: 0000000026926000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 mep_delete_implementation+0x292/0x340 net/bridge/br_cfm.c:591
 br_cfm_port_del+0x14f/0x1e0 net/bridge/br_cfm.c:872
 del_nbp+0x168/0xd50 net/bridge/br_if.c:348
 br_dev_delete+0x96/0x1c0 net/bridge/br_if.c:387
 br_net_exit_rtnl+0xdb/0x140 net/bridge/br.c:414
 ops_exit_rtnl_list net/core/net_namespace.c:181 [inline]
 ops_undo_list+0x896/0xab0 net/core/net_namespace.c:249
 cleanup_net+0x499/0x920 net/core/net_namespace.c:706
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387
 process_scheduled_works kernel/workqueue.c:3470 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__hlist_del include/linux/list.h:1038 [inline]
RIP: 0010:hlist_del_rcu include/linux/rculist.h:599 [inline]
RIP: 0010:br_del_frame+0x106/0x1a0 net/bridge/br_input.c:482
Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 87 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 65 18 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 76 49 89 1c 24 48 85 db 74 24 e8 c6 45 72 f7 48 8d
RSP: 0018:ffffc900000f78e8 EFLAGS: 00010a06
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 1bd5a00000000024 RSI: ffffffff8a98bb9f RDI: ffffffff91453338
RBP: ffffffff91453320 R08: 0000000000000001 R09: 000000000000002c
R10: 0000000000000200 R11: 0000000000000001 R12: dead000000000122
R13: ffff88802e200800 R14: 000000000000001c R15: ffff88802e200800
FS:  0000000000000000(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdcf9541e9c CR3: 0000000026926000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	00 fc                	add    %bh,%ah
   2:	ff                   	lcall  (bad)
   3:	df 48 89             	fisttps -0x77(%rax)
   6:	fa                   	cli
   7:	48 c1 ea 03          	shr    $0x3,%rdx
   b:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   f:	0f 85 87 00 00 00    	jne    0x9c
  15:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1c:	fc ff df
  1f:	4c 8b 65 18          	mov    0x18(%rbp),%r12
  23:	4c 89 e2             	mov    %r12,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	75 76                	jne    0xa6
  30:	49 89 1c 24          	mov    %rbx,(%r12)
  34:	48 85 db             	test   %rbx,%rbx
  37:	74 24                	je     0x5d
  39:	e8 c6 45 72 f7       	call   0xf7724604
  3e:	48                   	rex.W
  3f:	8d                   	.byte 0x8d

Crashes (325):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/25 21:23 upstream 818bebeb63dd a9a1fc32 .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/09/04 08:51 upstream 841e384b841a 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in br_del_frame
2026/09/03 09:45 upstream 940de590b839 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in br_del_frame
2026/09/03 09:19 upstream 940de590b839 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in br_del_frame
2026/09/01 20:30 upstream 786262be6048 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root general protection fault in br_del_frame
2026/09/01 16:13 upstream 786262be6048 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root general protection fault in br_del_frame
2026/08/30 06:26 upstream 08dbfad3f504 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in br_del_frame
2026/08/30 06:25 upstream 08dbfad3f504 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in br_del_frame
2026/08/29 23:27 upstream 08dbfad3f504 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root general protection fault in br_del_frame
2026/08/25 15:13 upstream 66498c75b4f8 614e416a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root general protection fault in br_del_frame
2026/08/11 15:45 upstream d58772d8520c 37a258dd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce general protection fault in br_del_frame
2026/08/09 19:13 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in br_del_frame
2026/08/04 02:45 upstream 075b74841bd0 a68cb31b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root general protection fault in br_del_frame
2026/08/04 02:44 upstream 075b74841bd0 a68cb31b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root general protection fault in br_del_frame
2026/09/01 08:55 upstream bf1079577a11 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in br_del_frame
2026/09/01 03:10 upstream bf1079577a11 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in br_del_frame
2026/08/26 21:38 upstream 502d45774af0 a2b77b9e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in br_del_frame
2026/08/26 11:44 upstream 45c13f3f9e3b 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in br_del_frame
2026/08/26 09:46 upstream 45c13f3f9e3b 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in br_del_frame
2026/08/26 08:15 upstream 45c13f3f9e3b 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in br_del_frame
2026/08/26 07:12 upstream 45c13f3f9e3b 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in br_del_frame
2026/08/21 12:25 upstream 7f063b2f17ea 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in br_del_frame
2026/08/21 12:24 upstream 7f063b2f17ea 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 general protection fault in br_del_frame
2026/09/03 01:21 upstream 940de590b839 6a988719 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/09/02 16:59 upstream 89a312991dc6 74e93e68 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/09/02 01:17 upstream 786262be6048 587f6b29 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/31 21:16 upstream cee9395acd80 00e9c810 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/29 02:31 upstream cf72cbb39da8 2f52988a .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/28 12:36 upstream 818bebeb63dd 41d151d4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/26 18:08 upstream 818bebeb63dd a2b77b9e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/26 14:46 upstream 818bebeb63dd a2b77b9e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/26 13:28 upstream 818bebeb63dd a2b77b9e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/25 23:18 upstream 818bebeb63dd 6a91adb4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/25 11:20 upstream 818bebeb63dd a9a1fc32 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/25 05:17 upstream 818bebeb63dd 614e416a .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/24 15:33 upstream 818bebeb63dd b55bd4c3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/24 13:43 upstream 818bebeb63dd b55bd4c3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/20 07:26 upstream a4ff2be345d0 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in br_del_frame
2026/08/30 19:34 upstream a23cbb05744b 2f52988a .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in br_del_frame
2026/08/29 12:39 upstream 548e7bcd0c54 2f52988a .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in br_del_frame
2026/08/27 08:42 upstream 73e3f0710014 c53a1b9c .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in br_del_frame
2026/08/21 15:35 upstream 818bebeb63dd 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in br_del_frame
2026/08/21 13:27 upstream 818bebeb63dd 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in br_del_frame
2026/09/03 19:09 net 544d85de4dc2 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in br_del_frame
2026/09/01 23:21 net 1d2929d0850f 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in br_del_frame
2026/09/01 12:56 net 545b63503c69 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in br_del_frame
2026/09/01 01:49 net 1376afc7660b 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in br_del_frame
2026/08/21 07:27 net 91ec20351349 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in br_del_frame
2026/08/20 17:25 net 564973a259ec 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in br_del_frame
2026/08/20 10:16 net 564973a259ec 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in br_del_frame
2026/08/19 16:48 net 564973a259ec 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in br_del_frame
2026/08/18 19:49 net 21040c7f9315 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in br_del_frame
2026/08/18 13:30 net 21040c7f9315 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in br_del_frame
2026/08/07 06:00 net-next 4fa4977a0d90 c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce general protection fault in br_del_frame
2026/08/24 22:59 linux-next 4b18edbd8e70 23caa175 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in br_del_frame
2026/09/02 02:21 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in br_del_frame
2026/08/28 14:28 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 bcbc8ceb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in br_del_frame
2026/08/27 15:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 68f892e99df9 e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in br_del_frame
2026/08/27 13:53 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 68f892e99df9 a2b77b9e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in br_del_frame
* Struck through repros no longer work on HEAD.