cess permissive=1 [ 14.887898][ T24] audit: type=1400 audit(1785571857.000:63): avc: denied { siginh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.214' (ED25519) to the list of known hosts. 2026/08/01 08:11:06 parsed 1 programs 2026/08/01 08:11:06 serving rpc on tcp://33405 [ 24.402368][ T24] audit: type=1400 audit(1785571866.580:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.423285][ T24] audit: type=1400 audit(1785571866.580:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.443338][ T24] audit: type=1400 audit(1785571866.580:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.088029][ T24] audit: type=1400 audit(1785571867.270:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.088958][ T293] cgroup: Unknown subsys name 'net' [ 25.110783][ T24] audit: type=1400 audit(1785571867.270:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.138265][ T24] audit: type=1400 audit(1785571867.300:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.138421][ T293] cgroup: Unknown subsys name 'devices' [ 25.226539][ T293] cgroup: Unknown subsys name 'hugetlb' [ 25.232362][ T293] cgroup: Unknown subsys name 'rlimit' [ 25.374114][ T24] audit: type=1400 audit(1785571867.550:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.397539][ T24] audit: type=1400 audit(1785571867.560:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.403132][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.418609][ T24] audit: type=1400 audit(1785571867.560:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.447291][ T24] audit: type=1400 audit(1785571867.560:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.487648][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.974230][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 25.983980][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.265875][ T328] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.272923][ T328] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.280486][ T328] device bridge_slave_0 entered promiscuous mode [ 26.287353][ T328] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.294463][ T328] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.301945][ T328] device bridge_slave_1 entered promiscuous mode [ 26.335877][ T328] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.342943][ T328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.350396][ T328] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.357527][ T328] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.373233][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.380577][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.388086][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.395555][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.406562][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.414952][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.422224][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.430904][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.439263][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.446424][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.459554][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.468849][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.481749][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.495176][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.503690][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.511615][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.520286][ T328] device veth0_vlan entered promiscuous mode [ 26.531491][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.541020][ T328] device veth1_macvtap entered promiscuous mode [ 26.549578][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.559470][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/08/01 08:11:09 executed programs: 0 [ 27.051542][ T366] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.059483][ T366] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.067371][ T366] device bridge_slave_0 entered promiscuous mode [ 27.077027][ T366] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.084051][ T366] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.091489][ T366] device bridge_slave_1 entered promiscuous mode [ 27.132319][ T366] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.139923][ T366] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.147412][ T366] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.154448][ T366] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.174776][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.182372][ T329] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.189644][ T329] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.198544][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.207437][ T329] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.214678][ T329] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.224060][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.232744][ T329] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.239904][ T329] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.254093][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.263052][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.271484][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.284149][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.292988][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.304221][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.312901][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.323002][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.330555][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.338291][ T366] device veth0_vlan entered promiscuous mode [ 27.350499][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.359360][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.368955][ T366] device veth1_macvtap entered promiscuous mode [ 27.378147][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.386215][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.394631][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.404741][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.413334][ T329] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.516633][ T371] ================================================================== [ 27.524935][ T371] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 27.531695][ T371] Write of size 8 at addr ffff8881112b6550 by task syz.2.17/371 [ 27.539316][ T371] [ 27.541749][ T371] CPU: 0 PID: 371 Comm: syz.2.17 Not tainted syzkaller #0 [ 27.548846][ T371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.559435][ T371] Call Trace: [ 27.563332][ T371] __dump_stack+0x21/0x24 [ 27.567921][ T371] dump_stack_lvl+0x1a7/0x208 [ 27.572600][ T371] ? show_regs_print_info+0x18/0x18 [ 27.577790][ T371] ? thaw_kernel_threads+0x220/0x220 [ 27.583221][ T371] print_address_description+0x7f/0x2c0 [ 27.589049][ T371] ? mutex_lock+0x85/0xf0 [ 27.593432][ T371] kasan_report+0x100/0x140 [ 27.597954][ T371] ? mutex_lock+0x85/0xf0 [ 27.602287][ T371] kasan_check_range+0x249/0x2a0 [ 27.607396][ T371] __kasan_check_write+0x14/0x20 [ 27.612520][ T371] mutex_lock+0x85/0xf0 [ 27.616670][ T371] ? mutex_trylock+0xb0/0xb0 [ 27.621266][ T371] ? l2tp_session_put+0xb2/0x1a0 [ 27.626202][ T371] ? l2tp_session_delete+0x3a9/0x4a0 [ 27.631561][ T371] pppol2tp_release+0x178/0x2b0 [ 27.636417][ T371] sock_close+0xb8/0x200 [ 27.640659][ T371] ? sock_mmap+0xa0/0xa0 [ 27.645092][ T371] __fput+0x2dc/0x730 [ 27.649234][ T371] ____fput+0x15/0x20 [ 27.653221][ T371] task_work_run+0x127/0x190 [ 27.657815][ T371] do_exit+0xa7c/0x24e0 [ 27.662712][ T371] ? finish_task_switch+0x1e2/0x5a0 [ 27.667924][ T371] ? put_task_struct+0x90/0x90 [ 27.672898][ T371] ? remove_hrtimer+0x225/0x490 [ 27.677861][ T371] ? __kasan_check_write+0x14/0x20 [ 27.683083][ T371] ? _raw_spin_lock_irq+0x95/0xf0 [ 27.688108][ T371] do_group_exit+0x149/0x310 [ 27.692783][ T371] ? __kasan_check_write+0x14/0x20 [ 27.698258][ T371] ? recalc_sigpending+0x1c4/0x230 [ 27.703366][ T371] get_signal+0xfb1/0x1300 [ 27.707900][ T371] arch_do_signal_or_restart+0xe7/0x11b0 [ 27.713548][ T371] ? nanosleep_copyout+0x120/0x120 [ 27.718773][ T371] ? get_timespec64+0x116/0x1b0 [ 27.723634][ T371] ? __ia32_sys_rt_sigreturn+0x730/0x730 [ 27.729269][ T371] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 27.734984][ T371] ? debug_smp_processor_id+0x17/0x20 [ 27.740350][ T371] exit_to_user_mode_loop+0xa2/0xe0 [ 27.745545][ T371] exit_to_user_mode_prepare+0x76/0xa0 [ 27.751025][ T371] syscall_exit_to_user_mode+0x1d/0x40 [ 27.756751][ T371] do_syscall_64+0x3d/0x40 [ 27.761186][ T371] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.767083][ T371] RIP: 0033:0x7fc5a7bcb197 [ 27.771491][ T371] Code: Unable to access opcode bytes at RIP 0x7fc5a7bcb16d. [ 27.779111][ T371] RSP: 002b:00007fff0f2b35c0 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 27.795963][ T371] RAX: fffffffffffffdfc RBX: 000055557ce78500 RCX: 00007fc5a7bcb197 [ 27.805696][ T371] RDX: 00007fff0f2b3600 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.815951][ T371] RBP: 00007fc5a7ca700c R08: 0000000000000000 R09: 0000000000000000 [ 27.824418][ T371] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 27.832610][ T371] R13: 00007fc5a7e97fac R14: 00007fc5a7e97fa0 R15: 00007fc5a7e97fa0 [ 27.840858][ T371] [ 27.843369][ T371] Allocated by task 370: [ 27.847629][ T371] __kasan_kmalloc+0xd4/0x100 [ 27.852350][ T371] __kmalloc+0x19f/0x330 [ 27.856658][ T371] l2tp_session_create+0x39/0xb60 [ 27.861695][ T371] pppol2tp_connect+0xbf5/0x1640 [ 27.866821][ T371] __sys_connect+0x3ce/0x450 [ 27.871504][ T371] __x64_sys_connect+0x7a/0x90 [ 27.876262][ T371] do_syscall_64+0x31/0x40 [ 27.880702][ T371] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.886581][ T371] [ 27.888906][ T371] Freed by task 371: [ 27.892793][ T371] kasan_set_track+0x4a/0x70 [ 27.897385][ T371] kasan_set_free_info+0x23/0x40 [ 27.902313][ T371] ____kasan_slab_free+0x125/0x160 [ 27.907501][ T371] __kasan_slab_free+0x11/0x20 [ 27.912257][ T371] slab_free_freelist_hook+0xc5/0x190 [ 27.917635][ T371] kfree+0xc0/0x270 [ 27.921462][ T371] l2tp_session_put+0xb2/0x1a0 [ 27.926236][ T371] l2tp_session_delete+0x3a9/0x4a0 [ 27.931429][ T371] pppol2tp_release+0x169/0x2b0 [ 27.936273][ T371] sock_close+0xb8/0x200 [ 27.940511][ T371] __fput+0x2dc/0x730 [ 27.944574][ T371] ____fput+0x15/0x20 [ 27.948549][ T371] task_work_run+0x127/0x190 [ 27.953135][ T371] do_exit+0xa7c/0x24e0 [ 27.957672][ T371] do_group_exit+0x149/0x310 [ 27.962736][ T371] get_signal+0xfb1/0x1300 [ 27.967160][ T371] arch_do_signal_or_restart+0xe7/0x11b0 [ 27.972909][ T371] exit_to_user_mode_loop+0xa2/0xe0 [ 27.978187][ T371] exit_to_user_mode_prepare+0x76/0xa0 [ 27.983643][ T371] syscall_exit_to_user_mode+0x1d/0x40 [ 27.989095][ T371] do_syscall_64+0x3d/0x40 [ 27.993560][ T371] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.999537][ T371] [ 28.002036][ T371] The buggy address belongs to the object at ffff8881112b6400 [ 28.002036][ T371] which belongs to the cache kmalloc-512 of size 512 [ 28.016085][ T371] The buggy address is located 336 bytes inside of [ 28.016085][ T371] 512-byte region [ffff8881112b6400, ffff8881112b6600) [ 28.029347][ T371] The buggy address belongs to the page: [ 28.035067][ T371] page:ffffea000444ad00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1112b4 [ 28.045390][ T371] head:ffffea000444ad00 order:2 compound_mapcount:0 compound_pincount:0 [ 28.053878][ T371] flags: 0x4000000000010200(slab|head) [ 28.059423][ T371] raw: 4000000000010200 ffffea00043e8b00 0000000400000004 ffff888100043080 [ 28.068002][ T371] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 28.076572][ T371] page dumped because: kasan: bad access detected [ 28.082972][ T371] page_owner tracks the page as allocated [ 28.088688][ T371] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 97, ts 4710675261, free_ts 0 [ 28.106994][ T371] prep_new_page+0x176/0x190 [ 28.111715][ T371] get_page_from_freelist+0x225f/0x23f0 [ 28.117286][ T371] __alloc_pages_nodemask+0x29a/0x640 [ 28.122685][ T371] new_slab+0x84/0x3f0 [ 28.126767][ T371] ___slab_alloc+0x2f8/0x4c0 [ 28.131360][ T371] __slab_alloc+0x63/0xa0 [ 28.135684][ T371] __kmalloc_track_caller+0x1e4/0x310 [ 28.141059][ T371] __alloc_skb+0xdc/0x520 [ 28.145386][ T371] alloc_skb_with_frags+0xa3/0x560 [ 28.150596][ T371] sock_alloc_send_pskb+0x87f/0x9a0 [ 28.155880][ T371] unix_dgram_sendmsg+0x6f3/0x18f0 [ 28.161176][ T371] sock_write_iter+0x2a6/0x3a0 [ 28.166032][ T371] vfs_write+0x770/0xd70 [ 28.170364][ T371] ksys_write+0x14a/0x260 [ 28.174691][ T371] __x64_sys_write+0x7b/0x90 [ 28.179370][ T371] do_syscall_64+0x31/0x40 [ 28.183772][ T371] page_owner free stack trace missing [ 28.189149][ T371] [ 28.191470][ T371] Memory state around the buggy address: [ 28.197271][ T371] ffff8881112b6400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.205329][ T371] ffff8881112b6480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.213389][ T371] >ffff8881112b6500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.221529][ T371] ^ [ 28.228210][ T371] ffff8881112b6580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.236366][ T371] ffff8881112b6600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.244432][ T371] ================================================================== [ 28.252570][ T371] Disabling lock debugging due to kernel taint