cess permissive=1 [ 15.671194][ T24] audit: type=1400 audit(1784522498.800:63): avc: denied { siginh } for pid=231 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.182' (ED25519) to the list of known hosts. 2026/07/20 04:41:47 parsed 1 programs 2026/07/20 04:41:47 serving rpc on tcp://46495 [ 24.592425][ T24] audit: type=1400 audit(1784522507.730:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.614565][ T24] audit: type=1400 audit(1784522507.730:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.634309][ T24] audit: type=1400 audit(1784522507.730:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.203999][ T24] audit: type=1400 audit(1784522508.350:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.205033][ T293] cgroup: Unknown subsys name 'net' [ 25.226638][ T24] audit: type=1400 audit(1784522508.350:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.253873][ T24] audit: type=1400 audit(1784522508.380:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.254024][ T293] cgroup: Unknown subsys name 'devices' [ 25.394442][ T293] cgroup: Unknown subsys name 'hugetlb' [ 25.400026][ T293] cgroup: Unknown subsys name 'rlimit' [ 25.512470][ T24] audit: type=1400 audit(1784522508.650:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.535688][ T24] audit: type=1400 audit(1784522508.650:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.556021][ T24] audit: type=1400 audit(1784522508.660:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.576248][ T24] audit: type=1400 audit(1784522508.660:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.601988][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 25.895856][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.223178][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 26.233516][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.612924][ T336] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.620318][ T336] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.627699][ T336] device bridge_slave_0 entered promiscuous mode [ 26.635270][ T336] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.642272][ T336] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.649531][ T336] device bridge_slave_1 entered promiscuous mode [ 26.680028][ T336] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.687076][ T336] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.694337][ T336] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.701344][ T336] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.718359][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.725905][ T310] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.733420][ T310] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.742004][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.750289][ T310] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.757345][ T310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.769034][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.777336][ T310] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.784365][ T310] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.793990][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.807222][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.817135][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.827629][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.835819][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.843324][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.851308][ T336] device veth0_vlan entered promiscuous mode [ 26.861363][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.870050][ T336] device veth1_macvtap entered promiscuous mode [ 26.878388][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.888436][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/20 04:41:50 executed programs: 0 [ 27.284328][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.291365][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.298779][ T365] device bridge_slave_0 entered promiscuous mode [ 27.310251][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.317329][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.324672][ T365] device bridge_slave_1 entered promiscuous mode [ 27.361709][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.368749][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.375998][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.383014][ T365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.398182][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.405724][ T310] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.412829][ T310] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.425945][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.434070][ T310] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.441066][ T310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.450034][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.458226][ T310] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.465268][ T310] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.480264][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 27.488315][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.501535][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.509747][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.521450][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.530436][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.545850][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.553947][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.561787][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.569330][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.577265][ T365] device veth0_vlan entered promiscuous mode [ 27.588577][ T365] device veth1_macvtap entered promiscuous mode [ 27.595285][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.603523][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.611549][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.623879][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.632093][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.647430][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.656020][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.666995][ T390] ================================================================== [ 27.675080][ T390] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 27.681729][ T390] Write of size 8 at addr ffff88810f990950 by task syz.2.17/390 [ 27.689324][ T390] [ 27.691637][ T390] CPU: 0 PID: 390 Comm: syz.2.17 Not tainted syzkaller #0 [ 27.698713][ T390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 27.708739][ T390] Call Trace: [ 27.712002][ T390] __dump_stack+0x21/0x24 [ 27.716303][ T390] dump_stack_lvl+0x1a7/0x208 [ 27.720952][ T390] ? show_regs_print_info+0x18/0x18 [ 27.726121][ T390] ? thaw_kernel_threads+0x220/0x220 [ 27.731378][ T390] ? debug_smp_processor_id+0x17/0x20 [ 27.736745][ T390] print_address_description+0x7f/0x2c0 [ 27.742273][ T390] ? mutex_lock+0x85/0xf0 [ 27.746587][ T390] kasan_report+0x100/0x140 [ 27.751066][ T390] ? mutex_lock+0x85/0xf0 [ 27.755368][ T390] kasan_check_range+0x249/0x2a0 [ 27.760279][ T390] __kasan_check_write+0x14/0x20 [ 27.765192][ T390] mutex_lock+0x85/0xf0 [ 27.769321][ T390] ? mutex_trylock+0xb0/0xb0 [ 27.773886][ T390] ? l2tp_session_put+0xb2/0x1a0 [ 27.778793][ T390] ? l2tp_session_delete+0x3a9/0x4a0 [ 27.784047][ T390] pppol2tp_release+0x178/0x2b0 [ 27.788870][ T390] sock_close+0xb8/0x200 [ 27.793094][ T390] ? sock_mmap+0xa0/0xa0 [ 27.797428][ T390] __fput+0x2dc/0x730 [ 27.801387][ T390] ____fput+0x15/0x20 [ 27.805360][ T390] task_work_run+0x127/0x190 [ 27.809928][ T390] exit_to_user_mode_loop+0xcb/0xe0 [ 27.815100][ T390] exit_to_user_mode_prepare+0x76/0xa0 [ 27.820534][ T390] syscall_exit_to_user_mode+0x1d/0x40 [ 27.825971][ T390] do_syscall_64+0x3d/0x40 [ 27.830362][ T390] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.836322][ T390] RIP: 0033:0x7f60d0bb2e99 [ 27.840711][ T390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.860407][ T390] RSP: 002b:00007ffd267df5b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 27.868803][ T390] RAX: 0000000000000000 RBX: 00007ffd267df6a0 RCX: 00007f60d0bb2e99 [ 27.876755][ T390] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 27.884701][ T390] RBP: 0000000000006bfa R08: 0000000000000001 R09: 0000000000000000 [ 27.892646][ T390] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 27.900592][ T390] R13: 00007f60d0e3afac R14: 00007f60d0e3afa8 R15: 00007f60d0e3afa0 [ 27.908544][ T390] [ 27.910864][ T390] Allocated by task 390: [ 27.915095][ T390] __kasan_kmalloc+0xd4/0x100 [ 27.919752][ T390] __kmalloc+0x19f/0x330 [ 27.923975][ T390] l2tp_session_create+0x39/0xb60 [ 27.928986][ T390] pppol2tp_connect+0xbf5/0x1640 [ 27.933906][ T390] __sys_connect+0x3ce/0x450 [ 27.938553][ T390] __x64_sys_connect+0x7a/0x90 [ 27.943295][ T390] do_syscall_64+0x31/0x40 [ 27.947684][ T390] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.953544][ T390] [ 27.955844][ T390] Freed by task 390: [ 27.959715][ T390] kasan_set_track+0x4a/0x70 [ 27.964277][ T390] kasan_set_free_info+0x23/0x40 [ 27.969184][ T390] ____kasan_slab_free+0x125/0x160 [ 27.974265][ T390] __kasan_slab_free+0x11/0x20 [ 27.979002][ T390] slab_free_freelist_hook+0xc5/0x190 [ 27.984347][ T390] kfree+0xc0/0x270 [ 27.988136][ T390] l2tp_session_put+0xb2/0x1a0 [ 27.992874][ T390] l2tp_session_delete+0x3a9/0x4a0 [ 27.997961][ T390] pppol2tp_release+0x169/0x2b0 [ 28.002784][ T390] sock_close+0xb8/0x200 [ 28.007004][ T390] __fput+0x2dc/0x730 [ 28.010958][ T390] ____fput+0x15/0x20 [ 28.014918][ T390] task_work_run+0x127/0x190 [ 28.019480][ T390] exit_to_user_mode_loop+0xcb/0xe0 [ 28.024649][ T390] exit_to_user_mode_prepare+0x76/0xa0 [ 28.030079][ T390] syscall_exit_to_user_mode+0x1d/0x40 [ 28.035512][ T390] do_syscall_64+0x3d/0x40 [ 28.039900][ T390] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.045759][ T390] [ 28.048077][ T390] The buggy address belongs to the object at ffff88810f990800 [ 28.048077][ T390] which belongs to the cache kmalloc-512 of size 512 [ 28.062113][ T390] The buggy address is located 336 bytes inside of [ 28.062113][ T390] 512-byte region [ffff88810f990800, ffff88810f990a00) [ 28.075359][ T390] The buggy address belongs to the page: [ 28.080987][ T390] page:ffffea00043e6400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f990 [ 28.091196][ T390] head:ffffea00043e6400 order:2 compound_mapcount:0 compound_pincount:0 [ 28.099495][ T390] flags: 0x4000000000010200(slab|head) [ 28.104928][ T390] raw: 4000000000010200 ffffea00043e3600 0000000300000003 ffff888100043080 [ 28.113485][ T390] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 28.122037][ T390] page dumped because: kasan: bad access detected [ 28.128420][ T390] page_owner tracks the page as allocated [ 28.134221][ T390] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 95, ts 3837404074, free_ts 0 [ 28.152247][ T390] prep_new_page+0x176/0x190 [ 28.156809][ T390] get_page_from_freelist+0x225f/0x23f0 [ 28.162326][ T390] __alloc_pages_nodemask+0x29a/0x640 [ 28.167689][ T390] new_slab+0x84/0x3f0 [ 28.171733][ T390] ___slab_alloc+0x2f8/0x4c0 [ 28.176293][ T390] __slab_alloc+0x63/0xa0 [ 28.180614][ T390] __kmalloc_track_caller+0x1e4/0x310 [ 28.185967][ T390] __alloc_skb+0xdc/0x520 [ 28.190277][ T390] alloc_uevent_skb+0x85/0x240 [ 28.195022][ T390] kobject_uevent_net_broadcast+0x335/0x5a0 [ 28.200888][ T390] kobject_uevent_env+0x52b/0x700 [ 28.205887][ T390] kobject_synth_uevent+0x452/0x940 [ 28.211058][ T390] uevent_store+0x4b/0x70 [ 28.215359][ T390] drv_attr_store+0x79/0xa0 [ 28.219838][ T390] sysfs_kf_write+0x129/0x150 [ 28.224488][ T390] kernfs_fop_write_iter+0x2bd/0x400 [ 28.229741][ T390] page_owner free stack trace missing [ 28.235080][ T390] [ 28.237384][ T390] Memory state around the buggy address: [ 28.242992][ T390] ffff88810f990800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.251028][ T390] ffff88810f990880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.259061][ T390] >ffff88810f990900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.267093][ T390] ^ [ 28.273737][ T390] ffff88810f990980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.281770][ T390] ffff88810f990a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.289811][ T390] ================================================================== [ 28.297858][ T390] Disabling lock debugging due to kernel taint