Warning: Permanently added '10.128.0.101' (ED25519) to the list of known hosts. 2026/07/17 02:30:55 parsed 1 programs 2026/07/17 02:30:55 serving rpc on tcp://39967 [ 26.570972][ T24] audit: type=1400 audit(1784255455.500:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 26.591869][ T24] audit: type=1400 audit(1784255455.510:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 26.611497][ T24] audit: type=1400 audit(1784255455.510:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 27.511212][ T24] audit: type=1400 audit(1784255456.440:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 27.514483][ T293] cgroup: Unknown subsys name 'net' [ 27.534000][ T24] audit: type=1400 audit(1784255456.450:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.561148][ T24] audit: type=1400 audit(1784255456.470:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.561671][ T293] cgroup: Unknown subsys name 'devices' [ 27.703256][ T293] cgroup: Unknown subsys name 'hugetlb' [ 27.708873][ T293] cgroup: Unknown subsys name 'rlimit' [ 27.856660][ T24] audit: type=1400 audit(1784255456.790:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 27.879853][ T24] audit: type=1400 audit(1784255456.790:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 27.900286][ T24] audit: type=1400 audit(1784255456.790:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.920593][ T24] audit: type=1400 audit(1784255456.790:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.924432][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 27.977848][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.331560][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 28.342382][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 28.718166][ T330] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.725256][ T330] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.732749][ T330] device bridge_slave_0 entered promiscuous mode [ 28.740299][ T330] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.747368][ T330] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.754795][ T330] device bridge_slave_1 entered promiscuous mode [ 28.794203][ T330] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.801261][ T330] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.808561][ T330] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.815625][ T330] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.832875][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.840878][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.848480][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.860036][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.868300][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.875334][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.883120][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.891220][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.898285][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.913050][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.920923][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.933768][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.944895][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.953079][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.960431][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.968471][ T330] device veth0_vlan entered promiscuous mode [ 28.978409][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.987580][ T330] device veth1_macvtap entered promiscuous mode [ 28.997360][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.007789][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/17 02:30:58 executed programs: 0 [ 29.564502][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.571909][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.579322][ T365] device bridge_slave_0 entered promiscuous mode [ 29.586531][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.593676][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.601002][ T365] device bridge_slave_1 entered promiscuous mode [ 29.645687][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.652740][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.670200][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.677817][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.685760][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.700494][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.708907][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.717143][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.724201][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.733636][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.741880][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.748909][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.762615][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.773984][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.786894][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.799718][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.807924][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.815456][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.823228][ T365] device veth0_vlan entered promiscuous mode [ 29.832988][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.842413][ T365] device veth1_macvtap entered promiscuous mode [ 29.851262][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.867809][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.921761][ C1] ================================================================== [ 29.929906][ C1] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 29.937288][ C1] Read of size 8 at addr ffff8881113e7990 by task ksoftirqd/1/19 [ 29.945006][ C1] [ 29.947361][ C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted syzkaller #0 [ 29.954671][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 29.964740][ C1] Call Trace: [ 29.968042][ C1] __dump_stack+0x21/0x24 [ 29.972384][ C1] dump_stack_lvl+0x1a7/0x208 [ 29.977078][ C1] ? show_regs_print_info+0x18/0x18 [ 29.982307][ C1] ? thaw_kernel_threads+0x220/0x220 [ 29.987749][ C1] print_address_description+0x7f/0x2c0 [ 29.993309][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 29.998348][ C1] kasan_report+0x100/0x140 [ 30.002905][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 30.007952][ C1] __asan_report_load8_noabort+0x14/0x20 [ 30.013599][ C1] rcu_cblist_dequeue+0x6c/0xb0 [ 30.018460][ C1] rcu_do_batch+0x448/0xaf0 [ 30.022983][ C1] ? local_bh_enable+0x20/0x20 [ 30.027763][ C1] ? psi_group_change+0x7cb/0xe00 [ 30.032809][ C1] ? compat_start_thread+0x80/0x80 [ 30.037938][ C1] rcu_core+0x50a/0xca0 [ 30.042111][ C1] ? rcu_cpu_kthread_park+0x90/0x90 [ 30.047323][ C1] ? __this_cpu_preempt_check+0x13/0x20 [ 30.052881][ C1] ? rcu_softirq_qs+0xd5/0x1d0 [ 30.057653][ C1] ? rcu_get_gp_kthreads_prio+0x10/0x10 [ 30.063215][ C1] rcu_core_si+0x9/0x10 [ 30.067382][ C1] __do_softirq+0x255/0x563 [ 30.071904][ C1] ? ksoftirqd_should_run+0x20/0x20 [ 30.077117][ C1] run_ksoftirqd+0x23/0x30 [ 30.081543][ C1] smpboot_thread_fn+0x464/0x820 [ 30.086520][ C1] kthread+0x324/0x3b0 [ 30.090601][ C1] ? cpu_report_death+0x1b0/0x1b0 [ 30.095634][ C1] ? kthread_blkcg+0xd0/0xd0 [ 30.100228][ C1] ret_from_fork+0x1f/0x30 [ 30.104655][ C1] [ 30.106997][ C1] Allocated by task 385: [ 30.111249][ C1] __kasan_kmalloc+0xd4/0x100 [ 30.115936][ C1] __kmalloc+0x19f/0x330 [ 30.120195][ C1] l2tp_session_create+0x39/0xb60 [ 30.125233][ C1] pppol2tp_connect+0xbf5/0x1640 [ 30.130198][ C1] __sys_connect+0x3ce/0x450 [ 30.134823][ C1] __x64_sys_connect+0x7a/0x90 [ 30.139595][ C1] do_syscall_64+0x31/0x40 [ 30.144040][ C1] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 30.149943][ C1] [ 30.152279][ C1] Freed by task 307: [ 30.156191][ C1] kasan_set_track+0x4a/0x70 [ 30.160795][ C1] kasan_set_free_info+0x23/0x40 [ 30.165746][ C1] ____kasan_slab_free+0x125/0x160 [ 30.170873][ C1] __kasan_slab_free+0x11/0x20 [ 30.175644][ C1] slab_free_freelist_hook+0xc5/0x190 [ 30.181033][ C1] kfree+0xc0/0x270 [ 30.184865][ C1] l2tp_session_put+0xb2/0x1a0 [ 30.189642][ C1] l2tp_session_delete+0x3a9/0x4a0 [ 30.194762][ C1] l2tp_tunnel_del_work+0x180/0x3d0 [ 30.199974][ C1] process_one_work+0x6fd/0xbc0 [ 30.204832][ C1] worker_thread+0xa8e/0x13c0 [ 30.209522][ C1] kthread+0x324/0x3b0 [ 30.213601][ C1] ret_from_fork+0x1f/0x30 [ 30.218019][ C1] [ 30.220362][ C1] Last potentially related work creation: [ 30.226093][ C1] kasan_save_stack+0x3a/0x60 [ 30.230785][ C1] __kasan_record_aux_stack+0xd2/0x100 [ 30.236261][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 30.242079][ C1] call_rcu+0x11a/0x1090 [ 30.246325][ C1] pppol2tp_release+0x1e3/0x2b0 [ 30.251178][ C1] sock_close+0xb8/0x200 [ 30.255425][ C1] __fput+0x2dc/0x730 [ 30.259414][ C1] ____fput+0x15/0x20 [ 30.263399][ C1] task_work_run+0x127/0x190 [ 30.267994][ C1] exit_to_user_mode_loop+0xcb/0xe0 [ 30.273201][ C1] exit_to_user_mode_prepare+0x76/0xa0 [ 30.278670][ C1] syscall_exit_to_user_mode+0x1d/0x40 [ 30.284128][ C1] do_syscall_64+0x3d/0x40 [ 30.288567][ C1] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 30.294458][ C1] [ 30.296793][ C1] The buggy address belongs to the object at ffff8881113e7800 [ 30.296793][ C1] which belongs to the cache kmalloc-512 of size 512 [ 30.310934][ C1] The buggy address is located 400 bytes inside of [ 30.310934][ C1] 512-byte region [ffff8881113e7800, ffff8881113e7a00) [ 30.324197][ C1] The buggy address belongs to the page: [ 30.329860][ C1] page:ffffea000444f900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1113e4 [ 30.340126][ C1] head:ffffea000444f900 order:2 compound_mapcount:0 compound_pincount:0 [ 30.348470][ C1] flags: 0x4000000000010200(slab|head) [ 30.353964][ C1] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 30.362565][ C1] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 30.371249][ C1] page dumped because: kasan: bad access detected [ 30.377985][ C1] page_owner tracks the page as allocated [ 30.383740][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 365, ts 29880695483, free_ts 29876151478 [ 30.402065][ C1] prep_new_page+0x176/0x190 [ 30.406659][ C1] get_page_from_freelist+0x225f/0x23f0 [ 30.412212][ C1] __alloc_pages_nodemask+0x29a/0x640 [ 30.417588][ C1] new_slab+0x84/0x3f0 [ 30.421662][ C1] ___slab_alloc+0x2f8/0x4c0 [ 30.426252][ C1] __slab_alloc+0x63/0xa0 [ 30.430591][ C1] __kmalloc+0x1f9/0x330 [ 30.434840][ C1] fib6_info_alloc+0x34/0xe0 [ 30.439434][ C1] ip6_route_info_create+0x4c7/0x1450 [ 30.444812][ C1] ip6_route_add+0x27/0x130 [ 30.449337][ C1] addrconf_permanent_addr+0x635/0x940 [ 30.454802][ C1] addrconf_notify+0x752/0xea0 [ 30.459566][ C1] raw_notifier_call_chain+0x90/0x100 [ 30.464949][ C1] __dev_notify_flags+0x2f4/0x5b0 [ 30.469976][ C1] dev_change_flags+0xe3/0x1a0 [ 30.474746][ C1] do_setlink+0xb19/0x29a0 [ 30.479161][ C1] page last free stack trace: [ 30.483846][ C1] __free_pages_ok+0x80b/0x830 [ 30.488617][ C1] __free_pages+0xd8/0x390 [ 30.493035][ C1] __free_slab+0xcf/0x190 [ 30.497367][ C1] unfreeze_partials+0x150/0x180 [ 30.502301][ C1] put_cpu_partial+0xc1/0x180 [ 30.506976][ C1] __slab_free+0x2c9/0x3a0 [ 30.511393][ C1] ___cache_free+0x10e/0x130 [ 30.515988][ C1] qlink_free+0x50/0x90 [ 30.520143][ C1] qlist_free_all+0x5f/0xb0 [ 30.524648][ C1] kasan_quarantine_reduce+0x14a/0x160 [ 30.530115][ C1] __kasan_slab_alloc+0x2f/0xe0 [ 30.534966][ C1] slab_post_alloc_hook+0x5d/0x2f0 [ 30.540079][ C1] kmem_cache_alloc+0x15a/0x2d0 [ 30.544931][ C1] sk_prot_alloc+0x5c/0x340 [ 30.549431][ C1] sk_alloc+0x38/0x4e0 [ 30.553500][ C1] unix_create1+0x8d/0x5f0 [ 30.557913][ C1] [ 30.560238][ C1] Memory state around the buggy address: [ 30.565868][ C1] ffff8881113e7880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.573946][ C1] ffff8881113e7900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.582022][ C1] >ffff8881113e7980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.590088][ C1] ^ [ 30.594680][ C1] ffff8881113e7a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.602743][ C1] ffff8881113e7a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.610805][ C1] ================================================================== [ 30.618882][ C1] Disabling lock debugging due to kernel taint