rocess permissive=1
[ 14.859321][ T28] audit: type=1400 audit(1785846689.149:63): avc: denied { siginh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
Warning: Permanently added '10.128.1.31' (ED25519) to the list of known hosts.
2026/08/04 12:31:52 parsed 1 programs
2026/08/04 12:31:52 serving rpc on tcp://35549
[ 37.838982][ T28] audit: type=1400 audit(1785846712.139:64): avc: denied { node_bind } for pid=294 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 37.860357][ T28] audit: type=1400 audit(1785846712.139:65): avc: denied { module_request } for pid=294 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 39.031940][ T28] audit: type=1400 audit(1785846713.329:66): avc: denied { mounton } for pid=300 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 39.035949][ T300] cgroup: Unknown subsys name 'net'
[ 39.054921][ T28] audit: type=1400 audit(1785846713.329:67): avc: denied { mount } for pid=300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 39.082477][ T28] audit: type=1400 audit(1785846713.359:68): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 39.084780][ T300] cgroup: Unknown subsys name 'devices'
[ 39.226052][ T300] cgroup: Unknown subsys name 'hugetlb'
[ 39.231694][ T300] cgroup: Unknown subsys name 'rlimit'
[ 39.345328][ T28] audit: type=1400 audit(1785846713.649:69): avc: denied { setattr } for pid=300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 39.368530][ T28] audit: type=1400 audit(1785846713.649:70): avc: denied { create } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 39.388942][ T28] audit: type=1400 audit(1785846713.649:71): avc: denied { write } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 39.409283][ T28] audit: type=1400 audit(1785846713.649:72): avc: denied { read } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 39.429637][ T28] audit: type=1400 audit(1785846713.649:73): avc: denied { mounton } for pid=300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 39.435805][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 39.498110][ T300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 40.235711][ T307] request_module fs-gadgetfs succeeded, but still no fs?
[ 40.796819][ T346] bridge0: port 1(bridge_slave_0) entered blocking state
[ 40.804149][ T346] bridge0: port 1(bridge_slave_0) entered disabled state
[ 40.811552][ T346] device bridge_slave_0 entered promiscuous mode
[ 40.818615][ T346] bridge0: port 2(bridge_slave_1) entered blocking state
[ 40.825688][ T346] bridge0: port 2(bridge_slave_1) entered disabled state
[ 40.833060][ T346] device bridge_slave_1 entered promiscuous mode
[ 40.878806][ T346] bridge0: port 2(bridge_slave_1) entered blocking state
[ 40.885881][ T346] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 40.893251][ T346] bridge0: port 1(bridge_slave_0) entered blocking state
[ 40.900430][ T346] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 40.920293][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 40.927948][ T10] bridge0: port 1(bridge_slave_0) entered disabled state
[ 40.935711][ T10] bridge0: port 2(bridge_slave_1) entered disabled state
[ 40.945747][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 40.954840][ T10] bridge0: port 1(bridge_slave_0) entered blocking state
[ 40.961929][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 40.972002][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 40.981348][ T10] bridge0: port 2(bridge_slave_1) entered blocking state
[ 40.988556][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 41.001934][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 41.011608][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 41.026838][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 41.039089][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 41.047552][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 41.055533][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 41.064000][ T346] device veth0_vlan entered promiscuous mode
[ 41.075324][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 41.085016][ T346] device veth1_macvtap entered promiscuous mode
[ 41.095135][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 41.105541][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 41.151611][ T346] syz-executor (346) used greatest stack depth: 22048 bytes left
2026/08/04 12:31:55 executed programs: 0
[ 41.542999][ T371] bridge0: port 1(bridge_slave_0) entered blocking state
[ 41.550423][ T371] bridge0: port 1(bridge_slave_0) entered disabled state
[ 41.557940][ T371] device bridge_slave_0 entered promiscuous mode
[ 41.571875][ T371] bridge0: port 2(bridge_slave_1) entered blocking state
[ 41.579017][ T371] bridge0: port 2(bridge_slave_1) entered disabled state
[ 41.586634][ T371] device bridge_slave_1 entered promiscuous mode
[ 41.637301][ T371] bridge0: port 2(bridge_slave_1) entered blocking state
[ 41.644401][ T371] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 41.651694][ T371] bridge0: port 1(bridge_slave_0) entered blocking state
[ 41.658764][ T371] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 41.679404][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 41.687078][ T43] bridge0: port 1(bridge_slave_0) entered disabled state
[ 41.695847][ T43] bridge0: port 2(bridge_slave_1) entered disabled state
[ 41.705251][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 41.713503][ T43] bridge0: port 1(bridge_slave_0) entered blocking state
[ 41.720579][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 41.734275][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 41.742500][ T43] bridge0: port 2(bridge_slave_1) entered blocking state
[ 41.749571][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 41.761279][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 41.769600][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 41.785708][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 41.794221][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 41.808662][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 41.818110][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 41.838105][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 41.846413][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 41.855180][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 41.863003][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 41.872104][ T371] device veth0_vlan entered promiscuous mode
[ 41.884337][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 41.892589][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 41.902715][ T371] device veth1_macvtap entered promiscuous mode
[ 41.912625][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 41.920618][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 41.929422][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 41.939020][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 41.947352][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 42.023857][ C0] ==================================================================
[ 42.032011][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0
[ 42.039451][ C0] Read of size 8 at addr ffff88812c773190 by task swapper/0/0
[ 42.046946][ C0]
[ 42.049308][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
[ 42.056356][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 42.066449][ C0] Call Trace:
[ 42.069750][ C0]
[ 42.072623][ C0] __dump_stack+0x21/0x24
[ 42.077002][ C0] dump_stack_lvl+0x110/0x170
[ 42.081715][ C0] ? __cfi_dump_stack_lvl+0x8/0x8
[ 42.086779][ C0] ? debug_smp_processor_id+0x17/0x20
[ 42.092188][ C0] ? rcu_cblist_dequeue+0x6c/0xb0
[ 42.097246][ C0] print_address_description+0x71/0x200
[ 42.102823][ C0] print_report+0x4a/0x60
[ 42.107217][ C0] kasan_report+0x122/0x150
[ 42.111788][ C0] ? rcu_cblist_dequeue+0x6c/0xb0
[ 42.116868][ C0] __asan_report_load8_noabort+0x14/0x20
[ 42.122542][ C0] rcu_cblist_dequeue+0x6c/0xb0
[ 42.127431][ C0] rcu_do_batch+0x4bc/0xc30
[ 42.131967][ C0] ? rcu_core+0xf00/0xf00
[ 42.136323][ C0] ? _raw_spin_unlock_irqrestore+0x5a/0x80
[ 42.142170][ C0] ? note_gp_changes+0x140/0x220
[ 42.147147][ C0] ? _raw_spin_unlock+0x4c/0x70
[ 42.152029][ C0] rcu_core+0x486/0xf00
[ 42.156217][ C0] ? rcu_cpu_kthread_park+0x90/0x90
[ 42.161446][ C0] ? kvm_sched_clock_read+0x18/0x40
[ 42.166687][ C0] ? run_rebalance_domains+0xf7/0x1c0
[ 42.172099][ C0] rcu_core_si+0x9/0x10
[ 42.176289][ C0] handle_softirqs+0x1d7/0x600
[ 42.181171][ C0] __irq_exit_rcu+0x52/0xf0
[ 42.185707][ C0] irq_exit_rcu+0x9/0x10
[ 42.189979][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0
[ 42.195708][ C0]
[ 42.198661][ C0]
[ 42.201616][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[ 42.207636][ C0] RIP: 0010:default_idle+0xf/0x20
[ 42.212691][ C0] Code: cc 00 00 cc cc 00 00 cc cc 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 53 5b 65 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[ 42.232331][ C0] RSP: 0018:ffffffff87007d58 EFLAGS: 00000257
[ 42.238502][ C0] RAX: ffff8881f6e00000 RBX: ffffffff8701c680 RCX: 8546af830a374400
[ 42.246521][ C0] RDX: 0000000000000001 RSI: ffffffff85ca6940 RDI: ffffffff85ca6900
[ 42.254522][ C0] RBP: ffffffff87007d58 R08: ffff8881f6e348b3 R09: 1ffff1103edc6916
[ 42.262623][ C0] R10: 0000000000000000 R11: ffffffff8500d380 R12: dffffc0000000000
[ 42.270814][ C0] R13: 0000000000000000 R14: ffffffff8701c680 R15: dffffc0000000000
[ 42.278811][ C0] ? __cfi_default_idle+0x10/0x10
[ 42.283989][ C0] arch_cpu_idle+0x1c/0x20
[ 42.288452][ C0] default_idle_call+0x71/0x1d0
[ 42.293323][ C0] do_idle+0x354/0x640
[ 42.297414][ C0] ? ct_irq_exit+0x9/0x10
[ 42.301761][ C0] ? irqentry_exit+0x30/0x40
[ 42.306367][ C0] ? idle_inject_timer_fn+0x60/0x60
[ 42.311596][ C0] cpu_startup_entry+0x43/0x60
[ 42.316378][ C0] rest_init+0x10a/0x130
[ 42.320642][ C0] ? __cfi_x86_late_time_init+0x8/0x8
[ 42.326057][ C0] arch_call_rest_init+0xe/0x10
[ 42.330967][ C0] start_kernel+0x483/0x4f1
[ 42.335525][ C0] x86_64_start_reservations+0x2a/0x2c
[ 42.341036][ C0] x86_64_start_kernel+0x7c/0x81
[ 42.346028][ C0] secondary_startup_64_no_verify+0xce/0xdb
[ 42.351953][ C0]
[ 42.354993][ C0]
[ 42.357327][ C0] Allocated by task 375:
[ 42.361675][ C0] kasan_set_track+0x4b/0x70
[ 42.366305][ C0] kasan_save_alloc_info+0x1f/0x30
[ 42.371434][ C0] __kasan_kmalloc+0x95/0xb0
[ 42.376077][ C0] __kmalloc+0xb4/0x1e0
[ 42.380273][ C0] l2tp_session_create+0x38/0xbd0
[ 42.385313][ C0] pppol2tp_connect+0xbf5/0x1640
[ 42.390272][ C0] __sys_connect+0x3da/0x460
[ 42.394881][ C0] __x64_sys_connect+0x7a/0x90
[ 42.399665][ C0] x64_sys_call+0x88d/0x9a0
[ 42.404184][ C0] do_syscall_64+0x4c/0xa0
[ 42.408615][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 42.414531][ C0]
[ 42.416873][ C0] Freed by task 43:
[ 42.420776][ C0] kasan_set_track+0x4b/0x70
[ 42.425381][ C0] kasan_save_free_info+0x2b/0x40
[ 42.430438][ C0] ____kasan_slab_free+0x132/0x180
[ 42.435563][ C0] __kasan_slab_free+0x11/0x20
[ 42.440344][ C0] slab_free_freelist_hook+0xc2/0x190
[ 42.445726][ C0] __kmem_cache_free+0xb7/0x1b0
[ 42.450599][ C0] kfree+0x6f/0xf0
[ 42.454330][ C0] l2tp_session_put+0xaf/0x1a0
[ 42.459105][ C0] l2tp_session_delete+0x3df/0x4d0
[ 42.464239][ C0] l2tp_tunnel_del_work+0x199/0x410
[ 42.469473][ C0] process_one_work+0x717/0xc30
[ 42.474334][ C0] worker_thread+0xa4d/0x11d0
[ 42.479045][ C0] kthread+0x281/0x320
[ 42.483129][ C0] ret_from_fork+0x1f/0x30
[ 42.487563][ C0]
[ 42.489893][ C0] Last potentially related work creation:
[ 42.495612][ C0] kasan_save_stack+0x3a/0x60
[ 42.500507][ C0] __kasan_record_aux_stack+0xb6/0xc0
[ 42.505989][ C0] kasan_record_aux_stack_noalloc+0xb/0x10
[ 42.511809][ C0] call_rcu+0xcf/0xf50
[ 42.515896][ C0] pppol2tp_release+0x1e3/0x2b0
[ 42.520767][ C0] sock_close+0xc9/0x220
[ 42.525030][ C0] __fput+0x1fd/0x8f0
[ 42.529028][ C0] ____fput+0x15/0x20
[ 42.533028][ C0] task_work_run+0x1e1/0x250
[ 42.537639][ C0] exit_to_user_mode_loop+0x9b/0xb0
[ 42.542854][ C0] exit_to_user_mode_prepare+0x87/0xd0
[ 42.548372][ C0] syscall_exit_to_user_mode+0x1a/0x30
[ 42.553847][ C0] do_syscall_64+0x58/0xa0
[ 42.558298][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 42.564213][ C0]
[ 42.566575][ C0] The buggy address belongs to the object at ffff88812c773000
[ 42.566575][ C0] which belongs to the cache kmalloc-512 of size 512
[ 42.580644][ C0] The buggy address is located 400 bytes inside of
[ 42.580644][ C0] 512-byte region [ffff88812c773000, ffff88812c773200)
[ 42.594020][ C0]
[ 42.596356][ C0] The buggy address belongs to the physical page:
[ 42.602791][ C0] page:ffffea0004b1dc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12c770
[ 42.613045][ C0] head:ffffea0004b1dc00 order:2 compound_mapcount:0 compound_pincount:0
[ 42.621380][ C0] flags: 0x4000000000010200(slab|head|zone=1)
[ 42.627472][ C0] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00
[ 42.636068][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 42.644780][ C0] page dumped because: kasan: bad access detected
[ 42.651202][ C0] page_owner tracks the page as allocated
[ 42.656934][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 19, tgid 19 (kworker/0:1), ts 41963814100, free_ts 41959028305
[ 42.677187][ C0] post_alloc_hook+0x1f5/0x210
[ 42.681972][ C0] prep_new_page+0x1c/0x110
[ 42.686492][ C0] get_page_from_freelist+0x2ca9/0x2d20
[ 42.692057][ C0] __alloc_pages+0x1fa/0x610
[ 42.696664][ C0] alloc_slab_page+0x6e/0xf0
[ 42.701280][ C0] new_slab+0x98/0x3e0
[ 42.705357][ C0] ___slab_alloc+0x70f/0xb70
[ 42.709991][ C0] __slab_alloc+0x5e/0xa0
[ 42.714347][ C0] __kmem_cache_alloc_node+0x204/0x2d0
[ 42.719829][ C0] __kmalloc+0xa4/0x1e0
[ 42.724016][ C0] ___neigh_create+0x6e3/0x1db0
[ 42.728886][ C0] __neigh_create+0x31/0x40
[ 42.733413][ C0] ip6_finish_output2+0xaaf/0x18b0
[ 42.738540][ C0] ip6_finish_output+0x60b/0xbe0
[ 42.743498][ C0] ip6_output+0x1fa/0x410
[ 42.747846][ C0] mld_sendpack+0x7ce/0xda0
[ 42.752370][ C0] page last free stack trace:
[ 42.757050][ C0] free_unref_page_prepare+0x80c/0x820
[ 42.762551][ C0] free_unref_page+0x93/0x530
[ 42.767242][ C0] __free_pages+0x67/0x100
[ 42.771671][ C0] free_large_kmalloc+0xae/0xf0
[ 42.776531][ C0] kfree+0x8b/0xf0
[ 42.780261][ C0] tipc_nametbl_stop+0x1294/0x12f0
[ 42.785386][ C0] tipc_exit_net+0x99/0x150
[ 42.789910][ C0] cleanup_net+0x5b0/0xb10
[ 42.794358][ C0] process_one_work+0x717/0xc30
[ 42.799225][ C0] worker_thread+0xa4d/0x11d0
[ 42.803911][ C0] kthread+0x281/0x320
[ 42.807997][ C0] ret_from_fork+0x1f/0x30
[ 42.812432][ C0]
[ 42.814768][ C0] Memory state around the buggy address:
[ 42.820412][ C0] ffff88812c773080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.828493][ C0] ffff88812c773100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.836564][ C0] >ffff88812c773180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 42.844633][ C0] ^
[ 42.849225][ C0] ffff88812c773200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 42.857295][ C0] ffff88812c773280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 42.865362][ C0] ==================================================================
[ 42.873489][ C0] Disabling lock debugging due to kernel taint
[ 42.895116][ T28] kauditd_printk_skb: 34 callbacks suppressed
[ 42.895133][ T28] audit: type=1400 audit(1785846717.189:108): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 42.923050][ T28] audit: type=1400 audit(17858467