syzkaller syzkaller login: [ 8.983468][ T110] udevd (110) used greatest stack depth: 23072 bytes left [ 8.999749][ T104] udevd (104) used greatest stack depth: 22888 bytes left [ 13.533043][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 13.533058][ T30] audit: type=1400 audit(1784327733.510:59): avc: denied { transition } for pid=224 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.544312][ T30] audit: type=1400 audit(1784327733.510:60): avc: denied { noatsecure } for pid=224 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.552031][ T30] audit: type=1400 audit(1784327733.510:61): avc: denied { write } for pid=224 comm="sh" path="pipe:[348]" dev="pipefs" ino=348 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 13.568386][ T30] audit: type=1400 audit(1784327733.510:62): avc: denied { rlimitinh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.587158][ T30] audit: type=1400 audit(1784327733.510:63): avc: denied { siginh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.10.9' (ED25519) to the list of known hosts. 2026/07/17 22:35:42 parsed 1 programs 2026/07/17 22:35:42 serving rpc on tcp://38635 [ 22.890677][ T30] audit: type=1400 audit(1784327742.870:64): avc: denied { node_bind } for pid=294 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 22.911543][ T30] audit: type=1400 audit(1784327742.870:65): avc: denied { module_request } for pid=294 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 23.592790][ T30] audit: type=1400 audit(1784327743.570:66): avc: denied { mounton } for pid=300 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.593747][ T300] cgroup: Unknown subsys name 'net' [ 23.615668][ T30] audit: type=1400 audit(1784327743.570:67): avc: denied { mount } for pid=300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.643028][ T30] audit: type=1400 audit(1784327743.600:68): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.643183][ T300] cgroup: Unknown subsys name 'devices' [ 23.789671][ T300] cgroup: Unknown subsys name 'hugetlb' [ 23.795289][ T300] cgroup: Unknown subsys name 'rlimit' [ 23.936098][ T30] audit: type=1400 audit(1784327743.910:69): avc: denied { setattr } for pid=300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.959789][ T30] audit: type=1400 audit(1784327743.910:70): avc: denied { create } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.980393][ T30] audit: type=1400 audit(1784327743.910:71): avc: denied { write } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.986246][ T304] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.001155][ T30] audit: type=1400 audit(1784327743.910:72): avc: denied { read } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.029941][ T30] audit: type=1400 audit(1784327743.910:73): avc: denied { mounton } for pid=300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.064561][ T300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.538294][ T307] request_module fs-gadgetfs succeeded, but still no fs? [ 25.158264][ T358] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.165482][ T358] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.173233][ T358] device bridge_slave_0 entered promiscuous mode [ 25.180191][ T354] syz-executor (354) used greatest stack depth: 22760 bytes left [ 25.180265][ T358] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.195088][ T358] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.202506][ T358] device bridge_slave_1 entered promiscuous mode [ 25.238598][ T358] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.245652][ T358] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.253080][ T358] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.260338][ T358] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.278054][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.285712][ T199] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.293461][ T199] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.302911][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.311104][ T199] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.318173][ T199] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.327240][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.335736][ T199] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.342824][ T199] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.354494][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.365500][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.379288][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.397516][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.406192][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.413740][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.422086][ T358] device veth0_vlan entered promiscuous mode [ 25.438650][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.447744][ T358] device veth1_macvtap entered promiscuous mode [ 25.456849][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.467057][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.500253][ T358] syz-executor (358) used greatest stack depth: 21504 bytes left 2026/07/17 22:35:45 executed programs: 0 [ 25.649785][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.656846][ T368] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.664778][ T368] device bridge_slave_0 entered promiscuous mode [ 25.672241][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.679651][ T368] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.686955][ T368] device bridge_slave_1 entered promiscuous mode [ 25.731005][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.738109][ T368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.745414][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.752468][ T368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.776268][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.784380][ T199] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.791907][ T199] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.804772][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.813150][ T199] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.820193][ T199] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.829409][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.838136][ T199] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.845327][ T199] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.864314][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.873504][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.886368][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.897285][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.905513][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.913519][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.928355][ T368] device veth0_vlan entered promiscuous mode [ 25.940425][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.950337][ T368] device veth1_macvtap entered promiscuous mode [ 25.960726][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.975067][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.015144][ C0] ================================================================== [ 26.023249][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 26.030656][ C0] Read of size 8 at addr ffff88812d992590 by task ksoftirqd/0/13 [ 26.038405][ C0] [ 26.040774][ C0] CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted syzkaller #0 [ 26.048070][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 26.059389][ C0] Call Trace: [ 26.062690][ C0] [ 26.065636][ C0] __dump_stack+0x21/0x30 [ 26.069984][ C0] dump_stack_lvl+0x110/0x170 [ 26.074673][ C0] ? show_regs_print_info+0x20/0x20 [ 26.079894][ C0] ? load_image+0x3f0/0x3f0 [ 26.084594][ C0] print_address_description+0x7f/0x2c0 [ 26.090156][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 26.095199][ C0] kasan_report+0x10f/0x150 [ 26.099717][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 26.104756][ C0] __asan_report_load8_noabort+0x14/0x20 [ 26.110404][ C0] rcu_cblist_dequeue+0x6c/0xb0 [ 26.