[ 7.235768][ T36] audit: type=1400 audit(1788827088.960:58): avc: denied { read } for pid=203 comm="getty" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
syzkaller
syzkaller login: [ 14.350327][ T36] audit: type=1400 audit(1788827096.080:59): avc: denied { transition } for pid=232 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 14.353740][ T36] audit: type=1400 audit(1788827096.080:60): avc: denied { noatsecure } for pid=232 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 14.356752][ T36] audit: type=1400 audit(1788827096.080:61): avc: denied { write } for pid=232 comm="sh" path="pipe:[1543]" dev="pipefs" ino=1543 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 14.359920][ T36] audit: type=1400 audit(1788827096.080:62): avc: denied { rlimitinh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 14.362633][ T36] audit: type=1400 audit(1788827096.080:63): avc: denied { siginh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
Warning: Permanently added '10.128.0.71' (ED25519) to the list of known hosts.
2026/09/08 00:25:05 parsed 1 programs
2026/09/08 00:25:05 serving rpc on tcp://39969
[ 23.914993][ T36] audit: type=1400 audit(1788827105.650:64): avc: denied { node_bind } for pid=302 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 25.091835][ T36] audit: type=1400 audit(1788827106.820:65): avc: denied { mounton } for pid=308 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 25.092851][ T308] cgroup: Unknown subsys name 'net'
[ 25.114494][ T36] audit: type=1400 audit(1788827106.820:66): avc: denied { mount } for pid=308 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 25.141768][ T36] audit: type=1400 audit(1788827106.850:67): avc: denied { unmount } for pid=308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 25.142003][ T308] cgroup: Unknown subsys name 'devices'
[ 25.266296][ T308] cgroup: Unknown subsys name 'hugetlb'
[ 25.272116][ T308] cgroup: Unknown subsys name 'rlimit'
[ 25.369879][ T36] audit: type=1400 audit(1788827107.100:68): avc: denied { setattr } for pid=308 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 25.393048][ T36] audit: type=1400 audit(1788827107.100:69): avc: denied { create } for pid=308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 25.413385][ T36] audit: type=1400 audit(1788827107.100:70): avc: denied { write } for pid=308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 25.433659][ T36] audit: type=1400 audit(1788827107.100:71): avc: denied { read } for pid=308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 25.453842][ T36] audit: type=1400 audit(1788827107.100:72): avc: denied { sys_module } for pid=308 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
[ 25.459985][ T313] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 25.474809][ T36] audit: type=1400 audit(1788827107.100:73): avc: denied { mounton } for pid=308 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 25.562734][ T308] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 26.668965][ T318] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 27.030771][ T338] bridge0: port 1(bridge_slave_0) entered blocking state
[ 27.037906][ T338] bridge0: port 1(bridge_slave_0) entered disabled state
[ 27.045778][ T338] bridge_slave_0: entered allmulticast mode
[ 27.052243][ T338] bridge_slave_0: entered promiscuous mode
[ 27.060148][ T338] bridge0: port 2(bridge_slave_1) entered blocking state
[ 27.067226][ T338] bridge0: port 2(bridge_slave_1) entered disabled state
[ 27.074527][ T338] bridge_slave_1: entered allmulticast mode
[ 27.080672][ T338] bridge_slave_1: entered promiscuous mode
[ 27.296447][ T338] bridge0: port 2(bridge_slave_1) entered blocking state
[ 27.303537][ T338] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 27.310868][ T338] bridge0: port 1(bridge_slave_0) entered blocking state
[ 27.317938][ T338] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 27.473579][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 27.491779][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 27.515485][ T350] bridge0: port 1(bridge_slave_0) entered blocking state
[ 27.522566][ T350] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 27.535832][ T350] bridge0: port 2(bridge_slave_1) entered blocking state
[ 27.542911][ T350] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 27.581891][ T338] veth0_vlan: entered promiscuous mode
[ 27.595941][ T338] veth1_macvtap: entered promiscuous mode
2026/09/08 00:25:09 executed programs: 0
[ 27.835674][ T379] bridge0: port 1(bridge_slave_0) entered blocking state
[ 27.842758][ T379] bridge0: port 1(bridge_slave_0) entered disabled state
[ 27.849887][ T379] bridge_slave_0: entered allmulticast mode
[ 27.856370][ T379] bridge_slave_0: entered promiscuous mode
[ 27.862862][ T379] bridge0: port 2(bridge_slave_1) entered blocking state
[ 27.870074][ T379] bridge0: port 2(bridge_slave_1) entered disabled state
[ 27.877353][ T379] bridge_slave_1: entered allmulticast mode
[ 27.883658][ T379] bridge_slave_1: entered promiscuous mode
[ 27.889798][ T382] bridge0: port 1(bridge_slave_0) entered blocking state
[ 27.896881][ T382] bridge0: port 1(bridge_slave_0) entered disabled state
[ 27.903923][ T382] bridge_slave_0: entered allmulticast mode
[ 27.910240][ T382] bridge_slave_0: entered promiscuous mode
[ 27.917745][ T382] bridge0: port 2(bridge_slave_1) entered blocking state
[ 27.924828][ T382] bridge0: port 2(bridge_slave_1) entered disabled state
[ 27.931863][ T382] bridge_slave_1: entered allmulticast mode
[ 27.938188][ T382] bridge_slave_1: entered promiscuous mode
[ 28.000990][ T383] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.008136][ T383] bridge0: port 1(bridge_slave_0) entered disabled state
[ 28.015585][ T383] bridge_slave_0: entered allmulticast mode
[ 28.021759][ T383] bridge_slave_0: entered promiscuous mode
[ 28.031147][ T383] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.038212][ T383] bridge0: port 2(bridge_slave_1) entered disabled state
[ 28.045288][ T383] bridge_slave_1: entered allmulticast mode
[ 28.051599][ T383] bridge_slave_1: entered promiscuous mode
[ 28.085004][ T46] bridge_slave_1: left allmulticast mode
[ 28.090677][ T46] bridge_slave_1: left promiscuous mode
[ 28.096339][ T46] bridge0: port 2(bridge_slave_1) entered disabled state
[ 28.103728][ T46] bridge_slave_0: left allmulticast mode
[ 28.109426][ T46] bridge_slave_0: left promiscuous mode
[ 28.115191][ T46] bridge0: port 1(bridge_slave_0) entered disabled state
[ 28.221692][ T385] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.228793][ T385] bridge0: port 1(bridge_slave_0) entered disabled state
[ 28.235894][ T385] bridge_slave_0: entered allmulticast mode
[ 28.242046][ T385] bridge_slave_0: entered promiscuous mode
[ 28.249096][ T385] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.256220][ T385] bridge0: port 2(bridge_slave_1) entered disabled state
[ 28.263306][ T385] bridge_slave_1: entered allmulticast mode
[ 28.270084][ T385] bridge_slave_1: entered promiscuous mode
[ 28.291377][ T46] veth1_macvtap: left promiscuous mode
[ 28.297158][ T46] veth0_vlan: left promiscuous mode
[ 28.399837][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.406925][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 28.421206][ T350] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.428277][ T350] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 28.475528][ T350] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.482596][ T350] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 28.490968][ T350] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.498036][ T350] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 28.525171][ T350] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.532235][ T350] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 28.540027][ T350] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.547093][ T350] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 28.564201][ T382] veth0_vlan: entered promiscuous mode
[ 28.598805][ T382] veth1_macvtap: entered promiscuous mode
[ 28.608158][ T379] veth0_vlan: entered promiscuous mode
[ 28.620985][ T383] veth0_vlan: entered promiscuous mode
[ 28.643961][ T379] veth1_macvtap: entered promiscuous mode
[ 28.672222][ T383] veth1_macvtap: entered promiscuous mode
[ 28.682773][ T13] bridge0: port 1(bridge_slave_0) entered blocking state
[ 28.689848][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 28.711540][ T13] bridge0: port 2(bridge_slave_1) entered blocking state
[ 28.718623][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 28.776275][ T385] veth0_vlan: entered promiscuous mode
[ 28.787194][ T385] veth1_macvtap: entered promiscuous mode
[ 28.944337][ T64] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[ 29.004101][ T45] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 29.011644][ T376] usb 6-1: new high-speed USB device number 2 using dummy_hcd
[ 29.054076][ T31] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[ 29.095707][ T64] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 29.106807][ T64] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 29.116731][ T64] usb 2-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00
[ 29.125856][ T64] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 29.165364][ T45] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 29.176688][ T376] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 29.187737][ T45] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 29.197608][ T376] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 29.207504][ T45] usb 3-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00
[ 29.216724][ T376] usb 6-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00
[ 29.225791][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 29.234848][ T376] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 29.243388][ T31] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 29.255385][ T31] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[ 29.266814][ T31] usb 4-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00
[ 29.276247][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 29.538950][ T64] wacom 0003:056A:033B.0001: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.1-1/input0
[ 29.550109][ T64] input input5: Absolute device without dev->absinfo, refusing to register
[ 29.558918][ T64] wacom 0003:056A:033B.0001: probe with driver wacom failed with error -22
[ 29.670501][ T45] wacom 0003:056A:033B.0002: hidraw1: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.2-1/input0
[ 29.682181][ T45] input input8: Absolute device without dev->absinfo, refusing to register
[ 29.682390][ T376] wacom 0003:056A:033B.0003: hidraw2: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.5-1/input0
[ 29.702716][ T45] wacom 0003:056A:033B.0002: probe with driver wacom failed with error -22
[ 29.714885][ T31] wacom 0003:056A:033B.0004: hidraw3: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.3-1/input0
[ 29.726141][ T376] input input11: Absolute device without dev->absinfo, refusing to register
[ 29.735345][ T31] input input14: Absolute device without dev->absinfo, refusing to register
[ 29.744547][ T376] wacom 0003:056A:033B.0003: probe with driver wacom failed with error -22
[ 29.754311][ T31] wacom 0003:056A:033B.0004: probe with driver wacom failed with error -22
[ 29.806407][ T64] usb 2-1: USB disconnect, device number 2
[ 29.866242][ T401] ==================================================================
[ 29.874339][ T401] BUG: KASAN: slab-use-after-free in usbhid_power+0x7c/0xd0
[ 29.881626][ T401] Read of size 8 at addr ffff8881194f4008 by task syz.2.19/401
[ 29.889169][ T401]
[ 29.891485][ T401] CPU: 0 UID: 0 PID: 401 Comm: syz.2.19 Not tainted syzkaller #0 5b18096d2acadad9f3a622c0de28b00c51d60767
[ 29.891502][ T401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 29.891510][ T401] Call Trace:
[ 29.891515][ T401]
[ 29.891520][ T401] __dump_stack+0x21/0x30
[ 29.891540][ T401] dump_stack_lvl+0x140/0x1c0
[ 29.891557][ T401] ? __cfi_dump_stack_lvl+0x10/0x10
[ 29.891574][ T401] print_address_description+0x71/0x210
[ 29.891592][ T401] print_report+0x4a/0x70
[ 29.891608][ T401] kasan_report+0x162/0x1a0
[ 29.891625][ T401] ? usbhid_power+0x7c/0xd0
[ 29.891642][ T401] ? __kmalloc_cache_noprof+0x23c/0x470
[ 29.891655][ T401] ? usbhid_power+0x7c/0xd0
[ 29.891671][ T401] __asan_report_load8_noabort+0x18/0x20
[ 29.891683][ T401] usbhid_power+0x7c/0xd0
[ 29.891700][ T401] hidraw_open+0x254/0x960
[ 29.891717][ T401] chrdev_open+0x4eb/0x610
[ 29.891736][ T401] ? __cfi_chrdev_open+0x10/0x10
[ 29.891750][ T401] ? bpf_lsm_file_open+0xd/0x20
[ 29.891767][ T401] ? __cfi_chrdev_open+0x10/0x10
[ 29.891780][ T401] do_dentry_open+0x97c/0x1510
[ 29.891798][ T401] vfs_open+0x86/0x240
[ 29.891815][ T401] ? __cfi_vfs_open+0x10/0x10
[ 29.891831][ T401] ? may_open+0x352/0x430
[ 29.891847][ T401] path_openat+0x2c49/0x35a0
[ 29.891863][ T401] ? schedule+0xc5/0x240
[ 29.891876][ T401] ? kasan_save_alloc_info+0x3a/0x50
[ 29.891887][ T401] ? getname+0x1b/0x30
[ 29.891900][ T401] ? x64_sys_call+0xe69/0x2ee0
[ 29.891912][ T401] ? do_syscall_64+0x57/0xf0
[ 29.891930][ T401] ? do_filp_open+0x440/0x440
[ 29.891947][ T401] do_filp_open+0x1f2/0x440
[ 29.891963][ T401] ? __cfi_do_filp_open+0x10/0x10
[ 29.891981][ T401] ? alloc_fd+0x4c1/0x570
[ 29.891996][ T401] do_sys_openat2+0x134/0x1d0
[ 29.892013][ T401] ? common_nsleep+0x93/0xb0
[ 29.892029][ T401] ? do_sys_open+0x100/0x100
[ 29.892047][ T401] __x64_sys_openat+0x13a/0x170
[ 29.892065][ T401] x64_sys_call+0xe69/0x2ee0
[ 29.892076][ T401] do_syscall_64+0x57/0xf0
[ 29.892093][ T401] ? clear_bhb_loop+0x50/0xa0
[ 29.892107][ T401] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 29.892121][ T401] RIP: 0033:0x7f04cb15e98e
[ 29.892132][ T401] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 29.892143][ T401] RSP: 002b:00007f04cc123b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 29.892158][ T401] RAX: ffffffffffffffda RBX: 00007f04cc1246c0 RCX: 00007f04cb15e98e
[ 29.892168][ T401] RDX: 0000000000000000 RSI: 00007f04cc123c00 RDI: ffffffffffffff9c
[ 29.892177][ T401] RBP: 00007f04cc123c00 R08: 0000000000000000 R09: 0000000000000000
[ 29.892186][ T401] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
[ 29.892194][ T401] R13: 00007f04cb426038 R14: 00007f04cb425fa0 R15: 00007fff562e6068
[ 29.892205][ T401]
[ 29.892209][ T401]
[ 30.175260][ T401] Allocated by task 328:
[ 30.179506][ T401] kasan_save_track+0x3e/0x80
[ 30.184201][ T401] kasan_save_alloc_info+0x3a/0x50
[ 30.189308][ T401] __kasan_slab_alloc+0x73/0x90
[ 30.194170][ T401] kmem_cache_alloc_node_noprof+0x1ca/0x420
[ 30.200056][ T401] kmalloc_reserve+0xcf/0x4f0
[ 30.204732][ T401] __alloc_skb+0x13f/0x360
[ 30.209163][ T401] netlink_alloc_large_skb+0xf7/0x1b0
[ 30.214545][ T401] netlink_sendmsg+0x576/0xad0
[ 30.219326][ T401] ____sys_sendmsg+0x99e/0xa00
[ 30.224084][ T401] ___sys_sendmsg+0x2a6/0x370
[ 30.228759][ T401] __x64_sys_sendmsg+0x1be/0x2a0
[ 30.233710][ T401] x64_sys_call+0x2a4c/0x2ee0
[ 30.238403][ T401] do_syscall_64+0x57/0xf0
[ 30.242823][ T401] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 30.248734][ T401]
[ 30.251048][ T401] Freed by task 328:
[ 30.254929][ T401] kasan_save_track+0x3e/0x80
[ 30.259600][ T401] kasan_save_free_info+0x44/0x50
[ 30.264616][ T401] __kasan_slab_free+0x5f/0x80
[ 30.269376][ T401] kfree+0x158/0x440
[ 30.273280][ T401] skb_free_head+0xf7/0x300
[ 30.277781][ T401] skb_release_data+0x6d0/0x860
[ 30.282628][ T401] __kfree_skb+0x62/0x210
[ 30.286951][ T401] consume_skb+0x65/0x1a0
[ 30.291294][ T401] netlink_unicast+0x8c7/0xa70
[ 30.296059][ T401] netlink_sendmsg+0x7d1/0xad0
[ 30.300833][ T401] ____sys_sendmsg+0x99e/0xa00
[ 30.305592][ T401] ___sys_sendmsg+0x2a6/0x370
[ 30.310282][ T401] __x64_sys_sendmsg+0x1be/0x2a0
[ 30.315247][ T401] x64_sys_call+0x2a4c/0x2ee0
[ 30.319919][ T401] do_syscall_64+0x57/0xf0
[ 30.324359][ T401] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 30.330258][ T401]
[ 30.332573][ T401] The buggy address belongs to the object at ffff8881194f4000
[ 30.332573][ T401] which belongs to the cache skbuff_small_head of size 768
[ 30.347145][ T401] The buggy address is located 8 bytes inside of
[ 30.347145][ T401] freed 768-byte region [ffff8881194f4000, ffff8881194f4300)
[ 30.360787][ T401]
[ 30.363107][ T401] The buggy address belongs to the physical page:
[ 30.369510][ T401] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1194f4
[ 30.378363][ T401] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 30.386876][ T401] flags: 0x4000000000000040(head|zone=1)
[ 30.392501][ T401] page_type: f5(slab)
[ 30.396479][ T401] raw: 4000000000000040 ffff888101a4ba00 dead000000000122 0000000000000000
[ 30.405052][ T401] raw: 0000000000000000 0000000080120012 00000001f5000000 0000000000000000
[ 30.413625][ T401] head: 4000000000000040 ffff888101a4ba00 dead000000000122 0000000000000000
[ 30.422286][ T401] head: 0000000000000000 0000000080120012 00000001f5000000 0000000000000000
[ 30.430945][ T401] head: 4000000000000002 ffffea0004653d01 ffffffffffffffff 0000000000000000
[ 30.439619][ T401] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 30.448286][ T401] page dumped because: kasan: bad access detected
[ 30.454708][ T401] page_owner tracks the page as allocated
[ 30.460434][ T401] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 64, tgid 64 (kworker/0:2), ts 29814653002, free_ts 29812825833
[ 30.481176][ T401] post_alloc_hook+0x37d/0x3b0
[ 30.485950][ T401] prep_new_page+0x2d/0x180
[ 30.490461][ T401] get_page_from_freelist+0x4aea/0x4ba0
[ 30.496010][ T401] __alloc_pages_noprof+0x35a/0x7e0
[ 30.501212][ T401] alloc_slab_page+0x6b/0x1e0
[ 30.505884][ T401] allocate_slab+0x69/0x430
[ 30.510384][ T401] ___slab_alloc+0x591/0x8c0
[ 30.514982][ T401] kmem_cache_alloc_node_noprof+0x29b/0x420
[ 30.520869][ T401] kmalloc_reserve+0xcf/0x4f0
[ 30.525560][ T401] __alloc_skb+0x13f/0x360
[ 30.529968][ T401] alloc_uevent_skb+0x85/0x240
[ 30.534729][ T401] kobject_uevent_net_broadcast+0x356/0x5e0
[ 30.540635][ T401] kobject_uevent_env+0x551/0x7e0
[ 30.545649][ T401] kobject_uevent+0x21/0x40
[ 30.550145][ T401] device_del+0xb7f/0xcf0
[ 30.554473][ T401] usb_disconnect+0x62c/0x950
[ 30.559166][ T401] page last free pid 64 tgid 64 stack trace:
[ 30.565130][ T401] free_unref_page+0xbb8/0xf70
[ 30.569887][ T401] __folio_put+0x272/0x2c0
[ 30.574318][ T401] free_large_kmalloc+0xb7/0x110
[ 30.579268][ T401] kfree+0x209/0x440
[ 30.583152][ T401] usbhid_disconnect+0xab/0xc0
[ 30.587938][ T401] usb_unbind_interface+0x2b0/0xa40
[ 30.593137][ T401] device_release_driver_internal+0x525/0x830
[ 30.599203][ T401] device_release_driver+0x1d/0x30
[ 30.604312][ T401] bus_remove_device+0x34f/0x370
[ 30.609244][ T401] device_del+0x583/0xcf0
[ 30.613589][ T401] usb_disable_device+0x3af/0x770
[ 30.618649][ T401] usb_disconnect+0x331/0x950
[ 30.623328][ T401] hub_event+0x1ad5/0x4360
[ 30.627754][ T401] process_scheduled_works+0x7f4/0x1060
[ 30.633291][ T401] worker_thread+0xc99/0x13f0
[ 30.637958][ T401] kthread+0x2c4/0x360
[ 30.642021][ T401]
[ 30.644334][ T401] Memory state around the buggy address:
[ 30.649950][ T401] ffff8881194f3f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 30.658006][ T401] ffff8881194f3f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 30.666070][ T401] >ffff8881194f4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 30.674135][ T401] ^
[ 30.678450][ T401] ffff8881194f4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 30.686498][ T401] ffff8881194f4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 30.694546][ T401] ==================================================================
[ 30.703932][ T401] Disabling lock debugging due to kernel taint
[ 30.716079][ T36] kauditd_printk_skb: 34 callbacks suppressed
[ 30.716094][ T36] audit: type=1400 audit(1788827112.450:108): avc: denied { read } for pid=92 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 30.717371][ T401] Oops: general protection fault, probably for non-canonical address 0x2a6014700000378: 0000 [#1] PREEMPT SMP KASAN PTI
[ 30.725381][ T36] audit: type=1400 audit(1788827112.450:109): avc: denied { search } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 30.743876][ T401] CPU: 0 UID: 0 PID: 401 Comm: syz.2.19 Tainted: G B syzkaller #0 5b18096d2acadad9f3a622c0de28b00c51d60767
[ 30.743912][ T401] Tainted: [B]=BAD_PAGE
[ 30.743920][ T401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 30.756735][ T36] audit: type=1400 audit(1788827112.450:110): avc: denied { write } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 30.777650][ T401] RIP: 0010:__pm_runtime_resume+0x49/0xa0
[ 30.777694][ T401] Code: ff e8 fb d4 3f fe 89 d8 83 e0 04 75 07 e8 af d0 3f fe eb 1e e8 a8 d0 3f fe 49 8d be e0 01 00 00 be 04 00 00 00 e8 07 ae 98 fe 41 ff 86 e0 01 00 00 4d 8d be 14 01 00 00 4c 89 ff e8 c0 67 5f
[ 30.777712][ T401] RSP: 0018:ffffc9000635f6a8 EFLAGS: 00010202
[ 30.777731][ T401] RAX: 0000000000000001 RBX: 0000000000000004 RCX: ffffffff8347a6c9
[ 30.791135][ T36] audit: type=1400 audit(1788827112.450:111): avc: denied { add_name } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 30.794618][ T401] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 02a6014700000378
[ 30.794637][ T401] RBP: ffffc9000635f6c8 R08: 02a601470000037c R09: 000000000000054c
[ 30.794654][ T401] R10: dffffc0000000000 R11: fffffbfff1177129 R12: 0000000000000000
[ 30.805028][ T36] audit: type=1400 audit(1788827112.450:112): avc: denied { create } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 30.825871][ T401] R13: ffffffff8680d060 R14: 02a6014700000198 R15: dffffc0000000000
[ 30.825891][ T401] FS: 00007f04cc1246c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 30.825912][ T401] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 30.825929][ T401] CR2: 000055df66763228 CR3: 000000012dc58000 CR4: 00000000003526b0
[ 30.831997][ T36] audit: type=1400 audit(1788827112.450:113): avc: denied { append open } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 30.851228][ T401] Call Trace:
[ 30.851238][ T401]
[ 30.851246][ T401] usb_autopm_get_interface+0x25/0xf0
[ 30.851273][ T401] usbhid_power+0x84/0xd0
[ 30.858174][ T36] audit: type=1400 audit(1788827112.450:114): avc: denied { getattr } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 30.865308][ T401] hidraw_open+0x254/0x960
[ 30.865342][ T401] chrdev_open+0x4eb/0x610
[ 31.031360][ T401] ? __cfi_chrdev_open+0x10/0x10
[ 31.036297][ T401] ? bpf_lsm_file_open+0xd/0x20
[ 31.041153][ T401] ? __cfi_chrdev_open+0x10/0x10
[ 31.046109][ T401] do_dentry_open+0x97c/0x1510
[ 31.050902][ T401] vfs_open+0x86/0x240
[ 31.054965][ T401] ? __cfi_vfs_open+0x10/0x10
[ 31.059655][ T401] ? may_open+0x352/0x430
[ 31.064028][ T401] path_openat+0x2c49/0x35a0
[ 31.068651][ T401] ? schedule+0xc5/0x240
[ 31.072889][ T401] ? kasan_save_alloc_info+0x3a/0x50
[ 31.078174][ T401] ? getname+0x1b/0x30
[ 31.082247][ T401] ? x64_sys_call+0xe69/0x2ee0
[ 31.087004][ T401] ? do_syscall_64+0x57/0xf0
[ 31.091591][ T401] ? do_filp_open+0x440/0x440
[ 31.096286][ T401] do_filp_open+0x1f2/0x440
[ 31.100789][ T401] ? __cfi_do_filp_open+0x10/0x10
[ 31.105812][ T401] ? alloc_fd+0x4c1/0x570
[ 31.110140][ T401] do_sys_openat2+0x134/0x1d0
[ 31.114837][ T401] ? common_nsleep+0x93/0xb0
[ 31.119423][ T401] ? do_sys_open+0x100/0x100
[ 31.124017][ T401] __x64_sys_openat+0x13a/0x170
[ 31.128883][ T401] x64_sys_call+0xe69/0x2ee0
[ 31.133490][ T401] do_syscall_64+0x57/0xf0
[ 31.137922][ T401] ? clear_bhb_loop+0x50/0xa0
[ 31.142596][ T401] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 31.148481][ T401] RIP: 0033:0x7f04cb15e98e
[ 31.152906][ T401] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 31.172502][ T401] RSP: 002b:00007f04cc123b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 31.180910][ T401] RAX: ffffffffffffffda RBX: 00007f04cc1246c0 RCX: 00007f04cb15e98e
[ 31.188876][ T401] RDX: 0000000000000000 RSI: 00007f04cc123c00 RDI: ffffffffffffff9c
[ 31.196850][ T401] RBP: 00007f04cc123c00 R08: 0000000000000000 R09: 0000000000000000
[ 31.204829][ T401] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
[ 31.212791][ T401] R13: 00007f04cb426038 R14: 00007f04cb425fa0 R15: 00007fff562e6068
[ 31.220764][ T401]
[ 31.223775][ T401] Modules linked in:
[ 31.227862][ T401] ---[ end trace 0000000000000000 ]---
[ 31.233363][ T401] RIP: 0010:__pm_runtime_resume+0x49/0xa0
[ 31.239193][ T401] Code: ff e8 fb d4 3f fe 89 d8 83 e0 04 75 07 e8 af d0 3f fe eb 1e e8 a8 d0 3f fe 49 8d be e0 01 00 00 be 04 00 00 00 e8 07 ae 98 fe 41 ff 86 e0 01 00 00 4d 8d be 14 01 00 00 4c 89 ff e8 c0 67 5f
[ 31.259185][ T401] RSP: 0018:ffffc9000635f6a8 EFLAGS: 00010202
[ 31.265755][ T401] RAX: 0000000000000001 RBX: 0000000000000004 RCX: ffffffff8347a6c9
[ 31.273792][ T401] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 02a6014700000378
[ 31.281933][ T401] RBP: ffffc9000635f6c8 R08: 02a601470000037c R09: 000000000000054c
[ 31.289984][ T401] R10: dffffc0000000000 R11: fffffbfff1177129 R12: 0000000000000000
[ 31.298096][ T401] R13: ffffffff8680d060 R14: 02a6014700000198 R15: dffffc0000000000
[ 31.306178][ T401] FS: 00007f04cc1246c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 31.315158][ T401] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 31.321783][ T401] CR2: 000055df66763228 CR3: 000000012dc58000 CR4: 00000000003526b0
[ 31.329787][ T401] Kernel panic - not syncing: Fatal exception
[ 31.336014][ T401] Kernel Offset: disabled
[ 31.340341][ T401] Rebooting in 86400 seconds..