syzkaller
syzkaller login: [ 21.494691][ T28] kauditd_printk_skb: 31 callbacks suppressed
[ 21.494710][ T28] audit: type=1400 audit(1787320218.527:59): avc: denied { transition } for pid=266 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 21.500418][ T28] audit: type=1400 audit(1787320218.527:60): avc: denied { noatsecure } for pid=266 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 21.504203][ T28] audit: type=1400 audit(1787320218.547:61): avc: denied { write } for pid=266 comm="sh" path="pipe:[13699]" dev="pipefs" ino=13699 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 21.508136][ T28] audit: type=1400 audit(1787320218.547:62): avc: denied { rlimitinh } for pid=266 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 21.511771][ T28] audit: type=1400 audit(1787320218.547:63): avc: denied { siginh } for pid=266 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 23.523382][ T274] scp (274) used greatest stack depth: 22216 bytes left
Warning: Permanently added '10.128.0.80' (ED25519) to the list of known hosts.
2026/08/21 13:50:28 parsed 1 programs
2026/08/21 13:50:28 serving rpc on tcp://45727
[ 30.972119][ T28] audit: type=1400 audit(1787320228.007:64): avc: denied { node_bind } for pid=294 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 30.993155][ T28] audit: type=1400 audit(1787320228.007:65): avc: denied { module_request } for pid=294 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 32.195165][ T28] audit: type=1400 audit(1787320229.227:66): avc: denied { mounton } for pid=300 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 32.198872][ T300] cgroup: Unknown subsys name 'net'
[ 32.217997][ T28] audit: type=1400 audit(1787320229.227:67): avc: denied { mount } for pid=300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 32.245359][ T28] audit: type=1400 audit(1787320229.257:68): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 32.245892][ T300] cgroup: Unknown subsys name 'devices'
[ 32.388419][ T300] cgroup: Unknown subsys name 'hugetlb'
[ 32.394538][ T300] cgroup: Unknown subsys name 'rlimit'
[ 32.507113][ T28] audit: type=1400 audit(1787320229.547:69): avc: denied { setattr } for pid=300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 32.530705][ T28] audit: type=1400 audit(1787320229.547:70): avc: denied { create } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 32.551151][ T28] audit: type=1400 audit(1787320229.547:71): avc: denied { write } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 32.571509][ T28] audit: type=1400 audit(1787320229.547:72): avc: denied { read } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 32.591952][ T28] audit: type=1400 audit(1787320229.547:73): avc: denied { mounton } for pid=300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 32.593941][ T304] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
Setting up swapspace version 1, size = 127995904 bytes
[ 32.718401][ T300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 33.470363][ T312] request_module fs-gadgetfs succeeded, but still no fs?
[ 33.990157][ T338] bridge0: port 1(bridge_slave_0) entered blocking state
[ 34.031086][ T338] bridge0: port 1(bridge_slave_0) entered disabled state
[ 34.044384][ T338] device bridge_slave_0 entered promiscuous mode
[ 34.077153][ T338] bridge0: port 2(bridge_slave_1) entered blocking state
[ 34.084293][ T338] bridge0: port 2(bridge_slave_1) entered disabled state
[ 34.103757][ T338] device bridge_slave_1 entered promiscuous mode
[ 34.299622][ T338] bridge0: port 2(bridge_slave_1) entered blocking state
[ 34.306771][ T338] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 34.314153][ T338] bridge0: port 1(bridge_slave_0) entered blocking state
[ 34.321269][ T338] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 34.352148][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 34.361037][ T357] bridge0: port 1(bridge_slave_0) entered disabled state
[ 34.368577][ T357] bridge0: port 2(bridge_slave_1) entered disabled state
[ 34.387362][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 34.396060][ T357] bridge0: port 1(bridge_slave_0) entered blocking state
[ 34.403194][ T357] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 34.411928][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 34.421151][ T357] bridge0: port 2(bridge_slave_1) entered blocking state
[ 34.428252][ T357] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 34.446980][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 34.456026][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 34.470065][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 34.484045][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 34.493324][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 34.501136][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 34.510300][ T338] device veth0_vlan entered promiscuous mode
[ 34.525098][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 34.536047][ T338] device veth1_macvtap entered promiscuous mode
[ 34.549329][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 34.562294][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
2026/08/21 13:50:31 executed programs: 0
[ 34.896616][ T380] bridge0: port 1(bridge_slave_0) entered blocking state
[ 34.903731][ T380] bridge0: port 1(bridge_slave_0) entered disabled state
[ 34.911407][ T380] device bridge_slave_0 entered promiscuous mode
[ 34.918644][ T380] bridge0: port 2(bridge_slave_1) entered blocking state
[ 34.925723][ T380] bridge0: port 2(bridge_slave_1) entered disabled state
[ 34.933586][ T380] device bridge_slave_1 entered promiscuous mode
[ 34.980844][ T379] bridge0: port 1(bridge_slave_0) entered blocking state
[ 34.988648][ T379] bridge0: port 1(bridge_slave_0) entered disabled state
[ 34.996279][ T379] device bridge_slave_0 entered promiscuous mode
[ 35.028724][ T379] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.035856][ T379] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.043503][ T379] device bridge_slave_1 entered promiscuous mode
[ 35.054354][ T376] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.061506][ T376] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.069244][ T376] device bridge_slave_0 entered promiscuous mode
[ 35.095594][ T381] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.102807][ T381] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.110418][ T381] device bridge_slave_0 entered promiscuous mode
[ 35.122944][ T376] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.130152][ T376] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.137723][ T376] device bridge_slave_1 entered promiscuous mode
[ 35.157115][ T381] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.164392][ T381] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.172134][ T381] device bridge_slave_1 entered promiscuous mode
[ 35.191558][ T375] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.198813][ T375] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.206311][ T375] device bridge_slave_0 entered promiscuous mode
[ 35.223275][ T375] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.230517][ T375] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.238057][ T375] device bridge_slave_1 entered promiscuous mode
[ 35.412026][ T376] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.419299][ T376] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 35.426612][ T376] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.433663][ T376] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 35.442511][ T380] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.449603][ T380] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 35.456949][ T380] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.463998][ T380] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 35.474118][ T379] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.481219][ T379] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 35.488543][ T379] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.495585][ T379] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 35.548633][ T381] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.555779][ T381] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 35.563133][ T381] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.570228][ T381] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 35.588167][ T375] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.595249][ T375] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 35.602612][ T375] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.609680][ T375] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 35.637759][ T357] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.645062][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 35.652935][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 35.661139][ T357] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.669413][ T357] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.676794][ T357] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.684098][ T357] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.691928][ T357] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.699368][ T357] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.706897][ T357] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.714208][ T357] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.721758][ T357] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.734229][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 35.742959][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 35.751537][ T357] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.758637][ T357] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 35.784858][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 35.792562][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 35.800205][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 35.809162][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 35.817886][ T357] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.824952][ T357] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 35.832488][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 35.841178][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 35.849480][ T357] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.856548][ T357] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 35.863984][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 35.871870][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 35.879594][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 35.888025][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 35.896323][ T357] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.903381][ T357] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 35.910887][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 35.919360][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 35.927703][ T357] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.934744][ T357] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 35.976687][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 35.984888][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 35.993194][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 36.001672][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 36.010204][ T357] bridge0: port 1(bridge_slave_0) entered blocking state
[ 36.017344][ T357] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 36.024844][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 36.034189][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 36.042540][ T357] bridge0: port 2(bridge_slave_1) entered blocking state
[ 36.049608][ T357] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 36.057112][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 36.065435][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 36.073897][ T357] bridge0: port 2(bridge_slave_1) entered blocking state
[ 36.081002][ T357] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 36.088484][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 36.096671][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 36.104670][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 36.112791][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 36.120899][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 36.129096][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 36.137197][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 36.145247][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 36.174273][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 36.183290][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 36.191977][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 36.200507][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 36.208788][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 36.217002][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 36.225324][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 36.233055][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 36.242714][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 36.251331][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 36.259724][ T357] bridge0: port 1(bridge_slave_0) entered blocking state
[ 36.266955][ T357] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 36.277432][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 36.290106][ T376] device veth0_vlan entered promiscuous mode
[ 36.303260][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 36.311632][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 36.319489][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 36.333593][ T380] device veth0_vlan entered promiscuous mode
[ 36.359601][ T381] device veth0_vlan entered promiscuous mode
[ 36.367061][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 36.375906][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 36.384564][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 36.392972][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 36.401240][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 36.409416][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 36.418085][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 36.426652][ T357] bridge0: port 2(bridge_slave_1) entered blocking state
[ 36.433699][ T357] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 36.441266][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 36.449375][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 36.457501][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 36.465622][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 36.473546][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 36.481156][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 36.488922][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 36.504494][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 36.522198][ T376] device veth1_macvtap entered promiscuous mode
[ 36.531302][ T375] device veth0_vlan entered promiscuous mode
[ 36.538491][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 36.548384][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 36.556687][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 36.564136][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 36.572598][ T381] device veth1_macvtap entered promiscuous mode
[ 36.597238][ T379] device veth0_vlan entered promiscuous mode
[ 36.604134][ T380] device veth1_macvtap entered promiscuous mode
[ 36.612266][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 36.621047][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 36.631032][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 36.639536][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 36.648359][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 36.656736][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 36.665116][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 36.673488][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 36.681760][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 36.689750][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 36.697950][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 36.706692][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 36.721303][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 36.730025][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 36.754690][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 36.764035][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 36.772927][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 36.781464][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 36.791863][ T379] device veth1_macvtap entered promiscuous mode
[ 36.801214][ T28] kauditd_printk_skb: 31 callbacks suppressed
[ 36.801229][ T28] audit: type=1400 audit(1787320233.837:105): avc: denied { mount } for pid=398 comm="syz.5.18" name="/" dev="configfs" ino=13484 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
[ 36.833255][ T28] audit: type=1400 audit(1787320233.837:106): avc: denied { search } for pid=398 comm="syz.5.18" name="/" dev="configfs" ino=13484 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 36.846344][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 36.867168][ T28] audit: type=1400 audit(1787320233.837:107): avc: denied { write } for pid=398 comm="syz.5.18" name="usb_gadget" dev="configfs" ino=13485 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 36.878182][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 36.892437][ T28] audit: type=1400 audit(1787320233.837:108): avc: denied { add_name } for pid=398 comm="syz.5.18" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 36.901418][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 36.919519][ T28] audit: type=1400 audit(1787320233.837:109): avc: denied { create } for pid=398 comm="syz.5.18" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1
[ 36.928373][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 36.948111][ T28] audit: type=1400 audit(1787320233.847:110): avc: denied { create } for pid=398 comm="syz.5.18" name="uac2.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1
[ 36.964346][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 36.975123][ T28] audit: type=1400 audit(1787320233.847:111): avc: denied { remove_name } for pid=398 comm="syz.5.18" name="uac2.usb0" dev="configfs" ino=16135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 36.984405][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 37.022287][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 37.022921][ T28] audit: type=1400 audit(1787320233.847:112): avc: denied { unlink } for pid=398 comm="syz.5.18" name="uac2.usb0" dev="configfs" ino=16135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[ 37.059117][ T28] audit: type=1400 audit(1787320233.847:113): avc: denied { rmdir } for pid=398 comm="syz.5.18" name="uac2.usb0" dev="configfs" ino=16134 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 37.095493][ T28] audit: type=1400 audit(1787320233.847:114): avc: denied { unmount } for pid=376 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
[ 37.123017][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 37.132717][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 37.142205][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 37.152211][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 37.162105][ T375] device veth1_macvtap entered promiscuous mode
[ 37.236365][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 37.244239][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 37.270096][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 37.282187][ T8] device bridge_slave_1 left promiscuous mode
[ 37.291166][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 37.316822][ T8] device bridge_slave_0 left promiscuous mode
[ 37.333625][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 37.371735][ T8] device veth1_macvtap left promiscuous mode
[ 37.382953][ T8] device veth0_vlan left promiscuous mode
[ 37.721650][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 37.733890][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
2026/08/21 13:50:36 executed programs: 484
[ 39.962260][ T1482] ==================================================================
[ 39.970472][ T1482] BUG: KASAN: use-after-free in config_item_get+0x27/0x90
[ 39.977628][ T1482] Write of size 4 at addr ffff888111e00c1c by task syz.6.557/1482
[ 39.985441][ T1482]
[ 39.987777][ T1482] CPU: 0 PID: 1482 Comm: syz.6.557 Not tainted syzkaller #0
[ 39.995085][ T1482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 40.005265][ T1482] Call Trace:
[ 40.008546][ T1482]
[ 40.011510][ T1482] __dump_stack+0x21/0x24
[ 40.015883][ T1482] dump_stack_lvl+0x110/0x170
[ 40.020596][ T1482] ? __cfi_dump_stack_lvl+0x8/0x8
[ 40.025671][ T1482] ? config_item_get+0x27/0x90
[ 40.030527][ T1482] print_address_description+0x71/0x200
[ 40.036117][ T1482] print_report+0x4a/0x60
[ 40.040494][ T1482] kasan_report+0x122/0x150
[ 40.045015][ T1482] ? config_item_get+0x27/0x90
[ 40.049794][ T1482] ? __kasan_check_write+0x14/0x20
[ 40.054917][ T1482] kasan_check_range+0x249/0x2a0
[ 40.059863][ T1482] __kasan_check_write+0x14/0x20
[ 40.064809][ T1482] config_item_get+0x27/0x90
[ 40.069415][ T1482] configfs_symlink+0x44f/0x1360
[ 40.074386][ T1482] ? show_sid+0x1d0/0x1d0
[ 40.078732][ T1482] ? from_kgid+0x14f/0x6a0
[ 40.083162][ T1482] ? __cfi_from_kgid+0x10/0x10
[ 40.087933][ T1482] ? __cfi_configfs_symlink+0x10/0x10
[ 40.093333][ T1482] ? selinux_inode_symlink+0x22/0x30
[ 40.098729][ T1482] ? security_inode_symlink+0xcf/0x120
[ 40.104217][ T1482] vfs_symlink+0x261/0x3f0
[ 40.108835][ T1482] do_symlinkat+0x24a/0x5d0
[ 40.113373][ T1482] __x64_sys_symlinkat+0x99/0xb0
[ 40.118329][ T1482] x64_sys_call+0x282/0x9a0
[ 40.122869][ T1482] do_syscall_64+0x4c/0xa0
[ 40.127322][ T1482] ? clear_bhb_loop+0x30/0x80
[ 40.132027][ T1482] ? clear_bhb_loop+0x30/0x80
[ 40.136819][ T1482] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 40.142733][ T1482] RIP: 0033:0x7fbabe19e0d9
[ 40.147193][ T1482] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 40.166816][ T1482] RSP: 002b:00007fbabf05d028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
[ 40.175256][ T1482] RAX: ffffffffffffffda RBX: 00007fbabe425fa0 RCX: 00007fbabe19e0d9
[ 40.183465][ T1482] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300
[ 40.191450][ T1482] RBP: 00007fbabe235024 R08: 0000000000000000 R09: 0000000000000000
[ 40.199443][ T1482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 40.207475][ T1482] R13: 00007fbabe426038 R14: 00007fbabe425fa0 R15: 00007fff6416cd68
[ 40.215465][ T1482]
[ 40.218683][ T1482]
[ 40.221037][ T1482] Allocated by task 1477:
[ 40.225364][ T1482] kasan_set_track+0x4b/0x70
[ 40.229967][ T1482] kasan_save_alloc_info+0x1f/0x30
[ 40.235095][ T1482] __kasan_kmalloc+0x95/0xb0
[ 40.239695][ T1482] kmalloc_trace+0x40/0xb0
[ 40.244138][ T1482] afunc_alloc_inst+0x4a/0x5e0
[ 40.248911][ T1482] usb_get_function_instance+0xf3/0x310
[ 40.254855][ T1482] function_make+0x118/0x360
[ 40.259457][ T1482] configfs_mkdir+0x518/0x9e0
[ 40.264142][ T1482] vfs_mkdir+0x39c/0x580
[ 40.268394][ T1482] do_mkdirat+0x174/0x4d0
[ 40.272739][ T1482] __x64_sys_mkdirat+0x89/0xa0
[ 40.277513][ T1482] x64_sys_call+0x73d/0x9a0
[ 40.282117][ T1482] do_syscall_64+0x4c/0xa0
[ 40.286539][ T1482] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 40.292450][ T1482]
[ 40.294857][ T1482] Freed by task 1477:
[ 40.298839][ T1482] kasan_set_track+0x4b/0x70
[ 40.303467][ T1482] kasan_save_free_info+0x2b/0x40
[ 40.308496][ T1482] ____kasan_slab_free+0x132/0x180
[ 40.313657][ T1482] __kasan_slab_free+0x11/0x20
[ 40.318440][ T1482] slab_free_freelist_hook+0xc2/0x190
[ 40.323912][ T1482] __kmem_cache_free+0xb7/0x1b0
[ 40.328971][ T1482] kfree+0x6f/0xf0
[ 40.332707][ T1482] afunc_free_inst+0x15/0x20
[ 40.337317][ T1482] usb_put_function_instance+0x9b/0xc0
[ 40.342879][ T1482] f_uac2_attr_release+0x15/0x20
[ 40.347820][ T1482] config_item_put+0x166/0x210
[ 40.352604][ T1482] configfs_rmdir+0x8c9/0x980
[ 40.357301][ T1482] vfs_rmdir+0x381/0x4f0
[ 40.361613][ T1482] do_rmdir+0x261/0x6b0
[ 40.365812][ T1482] __x64_sys_unlinkat+0xc7/0xf0
[ 40.370678][ T1482] x64_sys_call+0x79f/0x9a0
[ 40.375201][ T1482] do_syscall_64+0x4c/0xa0
[ 40.379626][ T1482] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 40.385540][ T1482]
[ 40.387879][ T1482] Last potentially related work creation:
[ 40.393628][ T1482] kasan_save_stack+0x3a/0x60
[ 40.398581][ T1482] __kasan_record_aux_stack+0xb6/0xc0
[ 40.404036][ T1482] kasan_record_aux_stack_noalloc+0xb/0x10
[ 40.410604][ T1482] call_rcu+0xcf/0xf50
[ 40.414849][ T1482] inetdev_event+0x87f/0x10a0
[ 40.419557][ T1482] raw_notifier_call_chain+0xa1/0x110
[ 40.424966][ T1482] unregister_netdevice_many+0x104a/0x1910
[ 40.431008][ T1482] ip6gre_exit_batch_net+0x5cd/0x620
[ 40.436362][ T1482] cleanup_net+0x630/0xb10
[ 40.440898][ T1482] process_one_work+0x717/0xc30
[ 40.445801][ T1482] worker_thread+0xa4d/0x11d0
[ 40.450597][ T1482] kthread+0x281/0x320
[ 40.454694][ T1482] ret_from_fork+0x1f/0x30
[ 40.459154][ T1482]
[ 40.461530][ T1482] The buggy address belongs to the object at ffff888111e00c00
[ 40.461530][ T1482] which belongs to the cache kmalloc-512 of size 512
[ 40.475592][ T1482] The buggy address is located 28 bytes inside of
[ 40.475592][ T1482] 512-byte region [ffff888111e00c00, ffff888111e00e00)
[ 40.488889][ T1482]
[ 40.491237][ T1482] The buggy address belongs to the physical page:
[ 40.497753][ T1482] page:ffffea0004478000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111e00
[ 40.508113][ T1482] head:ffffea0004478000 order:2 compound_mapcount:0 compound_pincount:0
[ 40.517064][ T1482] flags: 0x4000000000010200(slab|head|zone=1)
[ 40.523264][ T1482] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00
[ 40.531853][ T1482] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 40.540449][ T1482] page dumped because: kasan: bad access detected
[ 40.546870][ T1482] page_owner tracks the page as allocated
[ 40.552598][ T1482] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 103, tgid 103 (udevadm), ts 6542264973, free_ts 0
[ 40.572401][ T1482] post_alloc_hook+0x1f5/0x210
[ 40.577194][ T1482] prep_new_page+0x1c/0x110
[ 40.581738][ T1482] get_page_from_freelist+0x2ca9/0x2d20
[ 40.587305][ T1482] __alloc_pages+0x1fa/0x610
[ 40.591919][ T1482] alloc_slab_page+0x6e/0xf0
[ 40.596511][ T1482] new_slab+0x98/0x3e0
[ 40.600592][ T1482] ___slab_alloc+0x70f/0xb70
[ 40.605311][ T1482] __slab_alloc+0x5e/0xa0
[ 40.609672][ T1482] __kmem_cache_alloc_node+0x204/0x2d0
[ 40.615181][ T1482] __kmalloc_node_track_caller+0xa1/0x1e0
[ 40.620923][ T1482] __alloc_skb+0x226/0x4a0
[ 40.625382][ T1482] alloc_uevent_skb+0x85/0x240
[ 40.630171][ T1482] kobject_uevent_net_broadcast+0x343/0x5b0
[ 40.636096][ T1482] kobject_uevent_env+0x541/0x720
[ 40.641158][ T1482] kobject_synth_uevent+0x457/0x940
[ 40.646386][ T1482] uevent_store+0x4b/0x70
[ 40.650738][ T1482] page_owner free stack trace missing
[ 40.656204][ T1482]
[ 40.658546][ T1482] Memory state around the buggy address:
[ 40.664190][ T1482] ffff888111e00b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 40.672253][ T1482] ffff888111e00b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 40.680496][ T1482] >ffff888111e00c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.688571][ T1482] ^
[ 40.693433][ T1482] ffff888111e00c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.701499][ T1482] ffff888111e00d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 40.709568][ T1482] ==================================================================
[ 40.718286][ T1482] Disabling lock debugging due to kernel taint
[ 40.724465][ T1482] ------------[ cut here ]------------
[ 40.730075][ T1482] refcount_t: addition on 0; use-after-free.
[ 40.736347][ T1482] WARNING: CPU: 0 PID: 1482 at lib/refcount.c:25 refcount_warn_saturate+0x104/0x1a0
[ 40.745770][ T1482] Modules linked in:
[ 40.749751][ T1482] CPU: 0 PID: 1482 Comm: syz.6.557 Tainted: G B syzkaller #0
[ 40.758593][ T1482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 40.768695][ T1482] RIP: 0010:refcount_warn_saturate+0x104/0x1a0
[ 40.774888][ T1482] Code: 05 01 48 c7 c7 40 0d ca 85 e8 d8 28 d9 fe 0f 0b eb df e8 2f 9a 08 ff c6 05 0f ca 26 05 01 48 c7 c7 80 0c ca 85 e8 bc 28 d9 fe <0f> 0b eb c3 e8 13 9a 08 ff c6 05 f4 c9 26 05 01 48 c7 c7 e0 0c ca
[ 40.794661][ T1482] RSP: 0018:ffffc9000111fc58 EFLAGS: 00010246
[ 40.800861][ T1482] RAX: a1c818d929e0ac00 RBX: 0000000000000002 RCX: ffff888114d38000
[ 40.808933][ T1482] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 40.816956][ T1482] RBP: ffffc9000111fc68 R08: ffffc9000111f847 R09: 1ffff92000223f08
[ 40.824958][ T1482] R10: dffffc0000000000 R11: fffff52000223f09 R12: ffff88811de36d50
[ 40.833011][ T1482] R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000
[ 40.841084][ T1482] FS: 00007fbabf05d6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 40.850089][ T1482] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 40.856745][ T1482] CR2: 00007fbabe070000 CR3: 0000000133238000 CR4: 00000000003506b0
[ 40.864760][ T1482] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 40.872913][ T1482] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 40.881000][ T1482] Call Trace:
[ 40.884296][ T1482]
[ 40.887252][ T1482] config_item_get+0x8c/0x90
[ 40.891948][ T1482] configfs_symlink+0x44f/0x1360
[ 40.896932][ T1482] ? show_sid+0x1d0/0x1d0
[ 40.901291][ T1482] ? from_kgid+0x14f/0x6a0
[ 40.905734][ T1482] ? __cfi_from_kgid+0x10/0x10
[ 40.910534][ T1482] ? __cfi_configfs_symlink+0x10/0x10
[ 40.915922][ T1482] ? selinux_inode_symlink+0x22/0x30
[ 40.921242][ T1482] ? security_inode_symlink+0xcf/0x120
[ 40.926758][ T1482] vfs_symlink+0x261/0x3f0
[ 40.931300][ T1482] do_symlinkat+0x24a/0x5d0
[ 40.935823][ T1482] __x64_sys_symlinkat+0x99/0xb0
[ 40.940882][ T1482] x64_sys_call+0x282/0x9a0
[ 40.945413][ T1482] do_syscall_64+0x4c/0xa0
[ 40.950077][ T1482] ? clear_bhb_loop+0x30/0x80
[ 40.954997][ T1482] ? clear_bhb_loop+0x30/0x80
[ 40.959731][ T1482] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 40.965740][ T1482] RIP: 0033:0x7fbabe19e0d9
[ 40.970193][ T1482] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 40.990038][ T1482] RSP: 002b:00007fbabf05d028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
[ 40.998653][ T1482] RAX: ffffffffffffffda RBX: 00007fbabe425fa0 RCX: 00007fbabe19e0d9
[ 41.006718][ T1482] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300
[ 41.014754][ T1482] RBP: 00007fbabe235024 R08: 0000000000000000 R09: 0000000000000000
[ 41.022783][ T1482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 41.030810][ T1482] R13: 00007fbabe426038 R14: 00007fbabe425fa0 R15: 00007fff6416cd68
[ 41.038858][ T1482]
[ 41.041903][ T1482] ---[ end trace 0000000000000000 ]---
[ 41.060929][ T1482] ------------[ cut here ]------------
[ 41.066559][ T1482] refcount_t: underflow; use-after-free.
[ 41.073879][ T1482] WARNING: CPU: 0 PID: 1482 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0
[ 41.083474][ T1482] Modules linked in:
[ 41.087442][ T1482] CPU: 0 PID: 1482 Comm: syz.6.557 Tainted: G B W syzkaller #0
[ 41.096376][ T1482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 41.106703][ T1482] RIP: 0010:refcount_warn_saturate+0x120/0x1a0
[ 41.113118][ T1482] Code: 05 01 48 c7 c7 80 0c ca 85 e8 bc 28 d9 fe 0f 0b eb c3 e8 13 9a 08 ff c6 05 f4 c9 26 05 01 48 c7 c7 e0 0c ca 85 e8 a0 28 d9 fe <0f> 0b eb a7 e8 f7 99 08 ff c6 05 d5 c9 26 05 01 48 c7 c7 20 0c ca
[ 41.132819][ T1482] RSP: 0018:ffffc9000111fc38 EFLAGS: 00010246
[ 41.138973][ T1482] RAX: a1c818d929e0ac00 RBX: 0000000000000003 RCX: ffff888114d38000
[ 41.147028][ T1482] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
[ 41.155039][ T1482] RBP: ffffc9000111fc48 R08: ffff8881f6e2759b R09: 1ffff1103edc4eb3
[ 41.163116][ T1482] R10: dffffc0000000000 R11: ffffed103edc4eb4 R12: 00000000ffffffea
[ 41.171185][ T1482] R13: dffffc0000000000 R14: 0000000000000003 R15: 00000000c0000000
[ 41.179252][ T1482] FS: 00007fbabf05d6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 41.188253][ T1482] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 41.194879][ T1482] CR2: 00007fbabf03bff8 CR3: 0000000133238000 CR4: 00000000003506b0
[ 41.202982][ T1482] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 41.211033][ T1482] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 41.219117][ T1482] Call Trace:
[ 41.222461][ T1482]
[ 41.225439][ T1482] config_item_put+0x20e/0x210
[ 41.230323][ T1482] configfs_symlink+0x4a6/0x1360
[ 41.235301][ T1482] ? show_sid+0x1d0/0x1d0
[ 41.239733][ T1482] ? from_kgid+0x14f/0x6a0
[ 41.244191][ T1482] ? __cfi_from_kgid+0x10/0x10
[ 41.249053][ T1482] ? __cfi_configfs_symlink+0x10/0x10
[ 41.254466][ T1482] ? selinux_inode_symlink+0x22/0x30
[ 41.259869][ T1482] ? security_inode_symlink+0xcf/0x120
[ 41.265375][ T1482] vfs_symlink+0x261/0x3f0
[ 41.270012][ T1482] do_symlinkat+0x24a/0x5d0
[ 41.274576][ T1482] __x64_sys_symlinkat+0x99/0xb0
[ 41.279624][ T1482] x64_sys_call+0x282/0x9a0
[ 41.284169][ T1482] do_syscall_64+0x4c/0xa0
[ 41.288732][ T1482] ? clear_bhb_loop+0x30/0x80
[ 41.293446][ T1482] ? clear_bhb_loop+0x30/0x80
[ 41.298219][ T1482] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 41.304158][ T1482] RIP: 0033:0x7fbabe19e0d9
[ 41.308657][ T1482] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 41.328428][ T1482] RSP: 002b:00007fbabf05d028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
[ 41.336944][ T1482] RAX: ffffffffffffffda RBX: 00007fbabe425fa0 RCX: 00007fbabe19e0d9
[ 41.344948][ T1482] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300
[ 41.353298][ T1482] RBP: 00007fbabe235024 R08: 0000000000000000 R09: 0000000000000000
[ 41.361492][ T1482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 41.369557][ T1482] R13: 00007fbabe426038 R14: 00007fbabe425fa0 R15: 00007fff6416cd68
[ 41.377610][ T1482]
[ 41.380664][ T1482] ---[ end trace 0000000000000000 ]---
2026/08/21 13:50:41 executed programs: 1234
[ 44.718871][ T28] kauditd_printk_skb: 7 callbacks suppressed
[ 44.718888][ T28] audit: type=1400 audit(1787320241.757:122): avc: denied { write } for pid=294 comm="syz-execprog" path="pipe:[13819]" dev="pipefs" ino=13819 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
2026/08/21 13:50:46 executed programs: 2265