syzkaller syzkaller login: [ 13.498006][ T28] kauditd_printk_skb: 48 callbacks suppressed [ 13.498018][ T28] audit: type=1400 audit(1771503794.616:59): avc: denied { transition } for pid=225 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.502222][ T28] audit: type=1400 audit(1771503794.616:60): avc: denied { noatsecure } for pid=225 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.504815][ T28] audit: type=1400 audit(1771503794.616:61): avc: denied { write } for pid=225 comm="sh" path="pipe:[14734]" dev="pipefs" ino=14734 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 13.507880][ T28] audit: type=1400 audit(1771503794.616:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.510588][ T28] audit: type=1400 audit(1771503794.616:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.81' (ED25519) to the list of known hosts. 2026/02/19 12:23:23 parsed 1 programs [ 22.501140][ T28] audit: type=1400 audit(1771503803.616:64): avc: denied { node_bind } for pid=283 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 22.522032][ T28] audit: type=1400 audit(1771503803.616:65): avc: denied { module_request } for pid=283 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 23.235491][ T28] audit: type=1400 audit(1771503804.356:66): avc: denied { mounton } for pid=289 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.236509][ T289] cgroup: Unknown subsys name 'net' [ 23.258175][ T28] audit: type=1400 audit(1771503804.356:67): avc: denied { mount } for pid=289 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.285518][ T28] audit: type=1400 audit(1771503804.386:68): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.285684][ T289] cgroup: Unknown subsys name 'devices' [ 23.424040][ T289] cgroup: Unknown subsys name 'hugetlb' [ 23.429684][ T289] cgroup: Unknown subsys name 'rlimit' [ 23.537945][ T28] audit: type=1400 audit(1771503804.656:69): avc: denied { setattr } for pid=289 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.561116][ T28] audit: type=1400 audit(1771503804.656:70): avc: denied { create } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.581551][ T28] audit: type=1400 audit(1771503804.656:71): avc: denied { write } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.590360][ T293] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.601824][ T28] audit: type=1400 audit(1771503804.656:72): avc: denied { read } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.630524][ T28] audit: type=1400 audit(1771503804.656:73): avc: denied { mounton } for pid=289 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.661760][ T289] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.293633][ T296] request_module fs-gadgetfs succeeded, but still no fs? [ 24.393844][ T302] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.401154][ T302] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.409029][ T302] device bridge_slave_0 entered promiscuous mode [ 24.416775][ T302] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.423834][ T302] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.431126][ T302] device bridge_slave_1 entered promiscuous mode [ 24.468109][ T302] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.475163][ T302] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.482459][ T302] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.489499][ T302] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.508017][ T303] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.515450][ T303] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.523101][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.530506][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.540608][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.548933][ T303] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.555978][ T303] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.564562][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.572873][ T303] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.579885][ T303] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.591852][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.601015][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.614376][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.625179][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.633718][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.641128][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.650266][ T302] device veth0_vlan entered promiscuous mode [ 24.660093][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.669154][ T302] device veth1_macvtap entered promiscuous mode [ 24.678292][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.688131][ T303] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/02/19 12:23:26 executed programs: 0 [ 25.489123][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.496226][ T364] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.504196][ T364] device bridge_slave_0 entered promiscuous mode [ 25.513684][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.520709][ T364] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.528290][ T364] device bridge_slave_1 entered promiscuous mode [ 25.567968][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.575044][ T364] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.582458][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.589483][ T364] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.597959][ T8] device bridge_slave_1 left promiscuous mode [ 25.604265][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.611778][ T8] device bridge_slave_0 left promiscuous mode [ 25.618009][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.626062][ T8] device veth1_macvtap left promiscuous mode [ 25.632056][ T8] device veth0_vlan left promiscuous mode [ 25.735482][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.743087][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.750241][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.759091][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.767478][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.774515][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.784028][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.792693][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.799890][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.811505][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.820772][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.834216][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.845681][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.853890][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.861261][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.869513][ T364] device veth0_vlan entered promiscuous mode [ 25.879304][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.888464][ T364] device veth1_macvtap entered promiscuous mode [ 25.897938][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.907781][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.931457][ T374] loop2: detected capacity change from 0 to 1024 [ 25.938294][ T374] ======================================================= [ 25.938294][ T374] WARNING: The mand mount option has been deprecated and [ 25.938294][ T374] and is ignored by this kernel. Remove the mand [ 25.938294][ T374] option from the mount to silence this warning. [ 25.938294][ T374] ======================================================= [ 25.984576][ T374] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 25.997453][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.011869][ T378] loop2: detected capacity change from 0 to 1024 [ 26.025120][ T378] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.038431][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.052245][ T381] loop2: detected capacity change from 0 to 1024 [ 26.064101][ T381] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.075881][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.091951][ T384] loop2: detected capacity change from 0 to 1024 [ 26.103307][ T384] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.115767][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.130206][ T387] loop2: detected capacity change from 0 to 1024 [ 26.145112][ T387] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.157615][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.171449][ T390] loop2: detected capacity change from 0 to 1024 [ 26.183334][ T390] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.196436][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.210493][ T393] loop2: detected capacity change from 0 to 1024 [ 26.224159][ T393] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.236793][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.250498][ T396] loop2: detected capacity change from 0 to 1024 [ 26.264328][ T396] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.276528][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.290900][ T399] loop2: detected capacity change from 0 to 1024 [ 26.303867][ T399] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.316337][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.330495][ T402] loop2: detected capacity change from 0 to 1024 [ 26.344790][ T402] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.356785][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.373644][ T405] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.390342][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.419259][ T408] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.431511][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.453591][ T411] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.465683][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.503200][ T414] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.516376][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.543761][ T417] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.556346][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.583366][ T420] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.596626][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.626210][ T423] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.638484][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.663605][ T426] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.677369][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.713268][ T429] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.728188][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.763389][ T432] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.776516][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.813626][ T435] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.826251][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.844836][ T439] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.856842][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.885142][ T442] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.898762][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.923183][ T445] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.936103][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.954644][ T448] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 26.967590][ T364] EXT4-fs (loop2): unmounting filesystem. [ 26.993194][ T451] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 27.008284][ T364] EXT4-fs (loop2): unmounting filesystem. [ 27.033052][ T454] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 27.046040][ T364] EXT4-fs (loop2): unmounting filesystem. [ 27.064887][ T457] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 27.076343][ T364] EXT4-fs (loop2): unmounting filesystem. [ 27.094835][ T460] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 27.107720][ T364] EXT4-fs (loop2): unmounting filesystem. [ 27.134586][ T463] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 27.147313][ T364] EXT4-fs (loop2): unmounting filesystem. [ 27.164838][ T466] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 27.176836][ T364] EXT4-fs (loop2): unmounting filesystem. [ 27.194420][ T469] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. 2026/02/19 12:23:31 executed programs: 166 [ 30.494323][ T28] kauditd_printk_skb: 33 callbacks suppressed [ 30.494336][ T28] audit: type=1400 audit(1771503811.616:107): avc: denied { write } for pid=283 comm="syz-execprog" path="pipe:[14817]" dev="pipefs" ino=14817 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 30.936335][ T923] set_capacity_and_notify: 171 callbacks suppressed [ 30.936347][ T923] loop2: detected capacity change from 0 to 1024 [ 30.964669][ T926] loop2: detected capacity change from 0 to 1024 [ 30.983694][ T929] loop2: detected capacity change from 0 to 1024 [ 31.008540][ T932] loop2: detected capacity change from 0 to 1024 [ 31.035202][ T935] loop2: detected capacity change from 0 to 1024 [ 31.074510][ T938] loop2: detected capacity change from 0 to 1024 [ 31.095561][ T941] loop2: detected capacity change from 0 to 1024 [ 31.124225][ T944] loop2: detected capacity change from 0 to 1024 [ 31.146964][ T947] loop2: detected capacity change from 0 to 1024 [ 31.178301][ T950] loop2: detected capacity change from 0 to 1024 [ 33.123116][ T1197] EXT4-fs mount: 481 callbacks suppressed [ 33.123128][ T1197] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.141270][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.163383][ T1200] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.175928][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.194749][ T1203] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.207274][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.233267][ T1206] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.245387][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.263506][ T1209] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.275000][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.293343][ T1212] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.305807][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.332870][ T1215] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.346166][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.363227][ T1218] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.375334][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.394665][ T1221] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.406925][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.435116][ T1224] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.447121][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.464297][ T1227] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.475354][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.493205][ T1230] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.504970][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.533741][ T1233] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.547685][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.573321][ T1236] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.588404][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.614173][ T1239] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.626811][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.653177][ T1242] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.665922][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.693178][ T1245] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.705662][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.723698][ T1248] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.735913][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.754729][ T1251] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.767601][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.785427][ T1254] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.797158][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.816877][ T1257] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.829030][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.854655][ T1260] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.866875][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.883892][ T1263] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.894892][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.914629][ T1266] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.926847][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.944405][ T1269] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.956221][ T364] EXT4-fs (loop2): unmounting filesystem. [ 33.983100][ T1272] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 33.995675][ T364] EXT4-fs (loop2): unmounting filesystem. [ 34.013837][ T1275] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 34.027030][ T364] EXT4-fs (loop2): unmounting filesystem. [ 34.045069][ T1278] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 34.056925][ T364] EXT4-fs (loop2): unmounting filesystem. [ 34.074797][ T1281] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 34.086973][ T364] EXT4-fs (loop2): unmounting filesystem. [ 34.113242][ T1284] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 34.125616][ T364] EXT4-fs (loop2): unmounting filesystem. [ 34.144925][ T1287] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 34.156044][ T364] EXT4-fs (loop2): unmounting filesystem. [ 34.174590][ T1290] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 34.186282][ T364] EXT4-fs (loop2): unmounting filesystem. 2026/02/19 12:23:36 executed programs: 368 [ 35.948786][ T1525] set_capacity_and_notify: 189 callbacks suppressed [ 35.948800][ T1525] loop2: detected capacity change from 0 to 1024 [ 35.984450][ T1528] loop2: detected capacity change from 0 to 1024 [ 36.006542][ T1531] loop2: detected capacity change from 0 to 1024 [ 36.036316][ T1534] loop2: detected capacity change from 0 to 1024 [ 36.065790][ T1537] loop2: detected capacity change from 0 to 1024 [ 36.095027][ T1540] loop2: detected capacity change from 0 to 1024 [ 36.128140][ T1543] loop2: detected capacity change from 0 to 1024 [ 36.155506][ T1546] loop2: detected capacity change from 0 to 1024 [ 36.185687][ T1549] loop2: detected capacity change from 0 to 1024 [ 36.215182][ T1552] loop2: detected capacity change from 0 to 1024 2026/02/19 12:23:41 executed programs: 591 [ 40.799491][ T364] syz-executor (364) used greatest stack depth: 22016 bytes left [ 40.815543][ T2157] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.822705][ T2157] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.829991][ T2157] device bridge_slave_0 entered promiscuous mode [ 40.836889][ T2157] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.844024][ T2157] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.851316][ T2157] device bridge_slave_1 entered promiscuous mode [ 40.894374][ T2157] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.901456][ T2157] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.908737][ T2157] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.915779][ T2157] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.932485][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 40.940144][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.947780][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.957027][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 40.965303][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.972357][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.982644][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 40.990829][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.997962][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.009495][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 41.018785][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 41.033491][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 41.045307][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 41.053382][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 41.060828][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 41.070180][ T2157] device veth0_vlan entered promiscuous mode [ 41.080513][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 41.089803][ T2157] device veth1_macvtap entered promiscuous mode [ 41.098920][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 41.108760][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 41.133667][ T2167] set_capacity_and_notify: 197 callbacks suppressed [ 41.133681][ T2167] loop2: detected capacity change from 0 to 1024 [ 41.170877][ T2170] loop2: detected capacity change from 0 to 1024 [ 41.215799][ T2174] loop2: detected capacity change from 0 to 1024 [ 41.246035][ T2177] loop2: detected capacity change from 0 to 1024 [ 41.287559][ T2181] loop2: detected capacity change from 0 to 1024 [ 41.315668][ T2184] loop2: detected capacity change from 0 to 1024 [ 41.334348][ T436] device bridge_slave_1 left promiscuous mode [ 41.340508][ T436] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.348324][ T436] device bridge_slave_0 left promiscuous mode [ 41.354614][ T436] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.368841][ T436] device veth1_macvtap left promiscuous mode [ 41.374967][ T436] device veth0_vlan left promiscuous mode [ 41.374999][ T2187] loop2: detected capacity change from 0 to 1024 [ 41.417840][ T2190] loop2: detected capacity change from 0 to 1024 [ 41.469378][ T2194] loop2: detected capacity change from 0 to 1024 [ 41.499194][ T2197] loop2: detected capacity change from 0 to 1024 [ 41.734808][ T2224] ================================================================== [ 41.743009][ T2224] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x979/0x21d0 [ 41.750756][ T2224] Read of size 18446744073709551588 at addr ffff88811d144040 by task syz.2.638/2224 [ 41.760109][ T2224] [ 41.762426][ T2224] CPU: 1 PID: 2224 Comm: syz.2.638 Not tainted syzkaller #0 [ 41.769681][ T2224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 41.779817][ T2224] Call Trace: [ 41.783114][ T2224] [ 41.786030][ T2224] __dump_stack+0x21/0x24 [ 41.790343][ T2224] dump_stack_lvl+0x110/0x170 [ 41.795003][ T2224] ? __cfi_dump_stack_lvl+0x8/0x8 [ 41.800094][ T2224] ? kasan_save_alloc_info+0x25/0x30 [ 41.805367][ T2224] ? ext4_xattr_block_set+0x9d5/0x3260 [ 41.810808][ T2224] ? ext4_xattr_set+0x242/0x320 [ 41.815643][ T2224] ? ext4_xattr_security_set+0x3c/0x50 [ 41.821077][ T2224] ? ext4_xattr_set_entry+0x979/0x21d0 [ 41.826513][ T2224] print_address_description+0x71/0x200 [ 41.832036][ T2224] print_report+0x4a/0x60 [ 41.836343][ T2224] kasan_report+0x122/0x150 [ 41.840826][ T2224] ? ext4_xattr_set_entry+0x979/0x21d0 [ 41.846263][ T2224] ? ext4_xattr_set_entry+0x979/0x21d0 [ 41.851700][ T2224] kasan_check_range+0x249/0x2a0 [ 41.856624][ T2224] ? ext4_xattr_set_entry+0x979/0x21d0 [ 41.862064][ T2224] memmove+0x2d/0x70 [ 41.865952][ T2224] ext4_xattr_set_entry+0x979/0x21d0 [ 41.871311][ T2224] ext4_xattr_block_set+0xad3/0x3260 [ 41.876579][ T2224] ? __kasan_check_write+0x14/0x20 [ 41.881670][ T2224] ? iput+0x620/0x670 [ 41.885632][ T2224] ? ext4_xattr_block_find+0x310/0x310 [ 41.891084][ T2224] ext4_xattr_set_handle+0xbc4/0x12c0 [ 41.896544][ T2224] ? __cfi_ext4_xattr_set_handle+0x10/0x10 [ 41.902331][ T2224] ? __kasan_check_read+0x11/0x20 [ 41.907425][ T2224] ? __ext4_journal_start_sb+0x2ed/0x4a0 [ 41.913122][ T2224] ext4_xattr_set+0x242/0x320 [ 41.917780][ T2224] ? ns_capable+0x8c/0xf0 [ 41.922091][ T2224] ? __cfi_ext4_xattr_set+0x10/0x10 [ 41.927284][ T2224] ? selinux_inode_setxattr+0x5cf/0xbf0 [ 41.932854][ T2224] ext4_xattr_security_set+0x3c/0x50 [ 41.938115][ T2224] ? __cfi_ext4_xattr_security_set+0x10/0x10 [ 41.944078][ T2224] __vfs_setxattr+0x3f2/0x440 [ 41.948737][ T2224] __vfs_setxattr_noperm+0x12a/0x5e0 [ 41.954003][ T2224] __vfs_setxattr_locked+0x212/0x230 [ 41.959270][ T2224] vfs_setxattr+0x167/0x2e0 [ 41.963754][ T2224] ? __cfi_vfs_setxattr+0x10/0x10 [ 41.968754][ T2224] ? __kasan_check_write+0x14/0x20 [ 41.973843][ T2224] setxattr+0x346/0x360 [ 41.977980][ T2224] ? path_setxattr+0x290/0x290 [ 41.982725][ T2224] ? _raw_spin_unlock+0x4c/0x70 [ 41.987556][ T2224] ? __mnt_want_write+0x1e6/0x260 [ 41.992557][ T2224] ? mnt_want_write+0x220/0x300 [ 41.997395][ T2224] path_setxattr+0x147/0x290 [ 42.002000][ T2224] ? simple_xattr_list_add+0x120/0x120 [ 42.007442][ T2224] __x64_sys_setxattr+0xc5/0xe0 [ 42.012280][ T2224] x64_sys_call+0x633/0x9a0 [ 42.016762][ T2224] do_syscall_64+0x4c/0xa0 [ 42.021165][ T2224] ? clear_bhb_loop+0x30/0x80 [ 42.025822][ T2224] ? clear_bhb_loop+0x30/0x80 [ 42.030484][ T2224] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 42.036364][ T2224] RIP: 0033:0x7f06a6b9c629 [ 42.040781][ T2224] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.060459][ T2224] RSP: 002b:00007ffe84d44158 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc [ 42.068886][ T2224] RAX: ffffffffffffffda RBX: 00007f06a6e15fa0 RCX: 00007f06a6b9c629 [ 42.076840][ T2224] RDX: 00002000000013c0 RSI: 0000200000000140 RDI: 0000200000000100 [ 42.084802][ T2224] RBP: 00007f06a6c32b39 R08: 0000000000000000 R09: 0000000000000000 [ 42.092755][ T2224] R10: 0000000000000700 R11: 0000000000000246 R12: 0000000000000000 [ 42.100796][ T2224] R13: 00007f06a6e15fac R14: 00007f06a6e15fa0 R15: 00007f06a6e15fa0 [ 42.108779][ T2224] [ 42.111780][ T2224] [ 42.114084][ T2224] Allocated by task 2224: [ 42.118386][ T2224] kasan_set_track+0x4b/0x70 [ 42.122954][ T2224] kasan_save_alloc_info+0x25/0x30 [ 42.128047][ T2224] __kasan_kmalloc+0x95/0xb0 [ 42.132614][ T2224] __kmalloc_node_track_caller+0xb1/0x1e0 [ 42.138311][ T2224] kmemdup+0x2b/0x60 [ 42.142190][ T2224] ext4_xattr_block_set+0x9d5/0x3260 [ 42.147454][ T2224] ext4_xattr_set_handle+0xbc4/0x12c0 [ 42.152805][ T2224] ext4_xattr_set+0x242/0x320 [ 42.157464][ T2224] ext4_xattr_security_set+0x3c/0x50 [ 42.162743][ T2224] __vfs_setxattr+0x3f2/0x440 [ 42.167403][ T2224] __vfs_setxattr_noperm+0x12a/0x5e0 [ 42.172672][ T2224] __vfs_setxattr_locked+0x212/0x230 [ 42.177943][ T2224] vfs_setxattr+0x167/0x2e0 [ 42.182605][ T2224] setxattr+0x346/0x360 [ 42.186781][ T2224] path_setxattr+0x147/0x290 [ 42.191376][ T2224] __x64_sys_setxattr+0xc5/0xe0 [ 42.196214][ T2224] x64_sys_call+0x633/0x9a0 [ 42.200711][ T2224] do_syscall_64+0x4c/0xa0 [ 42.205109][ T2224] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 42.210997][ T2224] [ 42.213416][ T2224] The buggy address belongs to the object at ffff88811d144000 [ 42.213416][ T2224] which belongs to the cache kmalloc-1k of size 1024 [ 42.227444][ T2224] The buggy address is located 64 bytes inside of [ 42.227444][ T2224] 1024-byte region [ffff88811d144000, ffff88811d144400) [ 42.240698][ T2224] [ 42.243012][ T2224] The buggy address belongs to the physical page: [ 42.249408][ T2224] page:ffffea0004745000 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88811d142000 pfn:0x11d140 [ 42.260940][ T2224] head:ffffea0004745000 order:3 compound_mapcount:0 compound_pincount:0 [ 42.269245][ T2224] flags: 0x4000000000010200(slab|head|zone=1) [ 42.275308][ T2224] raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100043080 [ 42.283870][ T2224] raw: ffff88811d142000 000000008010000f 00000001ffffffff 0000000000000000 [ 42.292427][ T2224] page dumped because: kasan: bad access detected [ 42.298827][ T2224] page_owner tracks the page as allocated [ 42.304516][ T2224] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 103, tgid 103 (udevd), ts 5227212944, free_ts 0 [ 42.324117][ T2224] post_alloc_hook+0x1f5/0x210 [ 42.328872][ T2224] prep_new_page+0x1c/0x110 [ 42.333359][ T2224] get_page_from_freelist+0x2d12/0x2d80 [ 42.338891][ T2224] __alloc_pages+0x1d9/0x480 [ 42.343470][ T2224] alloc_slab_page+0x6e/0xf0 [ 42.348049][ T2224] new_slab+0x98/0x3d0 [ 42.352108][ T2224] ___slab_alloc+0x6bd/0xb20 [ 42.356689][ T2224] __slab_alloc+0x5e/0xa0 [ 42.361002][ T2224] __kmem_cache_alloc_node+0x203/0x2c0 [ 42.366446][ T2224] __kmalloc_node_track_caller+0xa0/0x1e0 [ 42.372144][ T2224] __alloc_skb+0x236/0x4b0 [ 42.376543][ T2224] netlink_sendmsg+0x635/0xbd0 [ 42.381288][ T2224] ____sys_sendmsg+0x5cc/0x990 [ 42.386040][ T2224] ___sys_sendmsg+0x2a2/0x360 [ 42.390700][ T2224] __x64_sys_sendmsg+0x205/0x2d0 [ 42.395644][ T2224] x64_sys_call+0x171/0x9a0 [ 42.400129][ T2224] page_owner free stack trace missing [ 42.405471][ T2224] [ 42.407779][ T2224] Memory state around the buggy address: [ 42.413472][ T2224] ffff88811d143f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.421511][ T2224] ffff88811d143f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.429553][ T2224] >ffff88811d144000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.437588][ T2224] ^ [ 42.443719][ T2224] ffff88811d144080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.451758][ T2224] ffff88811d144100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.459798][ T2224] ================================================================== [ 42.470099][ T2224] Disabling lock debugging due to kernel taint [ 42.476842][ T28] audit: type=1400 audit(1771503823.586:108): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 42.498734][ T28] audit: type=1400 audit(1771503823.586:109): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 42.521526][ T28] audit: type=1400 audit(1771503823.586:110): avc: denied { write } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 42.543572][ T28] audit: type=1400 audit(1771503823.586:111): avc: denied { add_name } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 42.564295][ T28] audit: type=1400 audit(1771503823.596:112): avc: denied { create } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 42.584944][ T28] audit: type=1400 audit(1771503823.596:113): avc: denied { append open } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 42.608501][ T28] audit: type=1400 audit(1771503823.596:114): avc: denied { getattr } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 2026/02/19 12:23:46 executed programs: 752 [ 46.145705][ T2678] set_capacity_and_notify: 157 callbacks suppressed [ 46.145720][ T2678] loop2: detected capacity change from 0 to 1024 [ 46.174588][ T2681] loop2: detected capacity change from 0 to 1024 [ 46.215968][ T2685] loop2: detected capacity change from 0 to 1024 [ 46.244700][ T2688] loop2: detected capacity change from 0 to 1024 [ 46.275995][ T2691] loop2: detected capacity change from 0 to 1024 [ 46.308958][ T2694] loop2: detected capacity change from 0 to 1024 [ 46.334392][ T2697] loop2: detected capacity change from 0 to 1024 [ 46.360442][ T2700] loop2: detected capacity change from 0 to 1024 [ 46.385391][ T2703] loop2: detected capacity change from 0 to 1024 [ 46.416083][ T2706] loop2: detected capacity change from 0 to 1024 2026/02/19 12:23:51 executed programs: 968 [ 51.163681][ T3314] set_capacity_and_notify: 198 callbacks suppressed [ 51.163695][ T3314] loop2: detected capacity change from 0 to 1024 [ 51.194733][ T3317] loop2: detected capacity change from 0 to 1024 [ 51.226368][ T3320] loop2: detected capacity change from 0 to 1024 [ 51.268246][ T3323] loop2: detected capacity change from 0 to 1024 [ 51.293392][ T3326] loop2: detected capacity change from 0 to 1024 [ 51.315599][ T3329] loop2: detected capacity change from 0 to 1024 [ 51.344478][ T3332] loop2: detected capacity change from 0 to 1024 [ 51.377278][ T3336] loop2: detected capacity change from 0 to 1024 [ 51.414729][ T3339] loop2: detected capacity change from 0 to 1024 [ 51.466477][ T3343] loop2: detected capacity change from 0 to 1024