rocess permissive=1 [ 16.203344][ T24] audit: type=1400 audit(1785695469.340:63): avc: denied { siginh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.43' (ED25519) to the list of known hosts. 2026/08/02 18:31:19 parsed 1 programs 2026/08/02 18:31:19 serving rpc on tcp://36139 [ 26.012022][ T24] audit: type=1400 audit(1785695479.210:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 26.033380][ T24] audit: type=1400 audit(1785695479.210:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 26.067346][ T24] audit: type=1400 audit(1785695479.210:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 26.999625][ T24] audit: type=1400 audit(1785695480.200:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 27.003132][ T293] cgroup: Unknown subsys name 'net' [ 27.022694][ T24] audit: type=1400 audit(1785695480.200:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.050501][ T24] audit: type=1400 audit(1785695480.240:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.051000][ T293] cgroup: Unknown subsys name 'devices' [ 27.219224][ T293] cgroup: Unknown subsys name 'hugetlb' [ 27.224877][ T293] cgroup: Unknown subsys name 'rlimit' [ 27.373946][ T24] audit: type=1400 audit(1785695480.570:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 27.397559][ T24] audit: type=1400 audit(1785695480.570:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 27.418262][ T24] audit: type=1400 audit(1785695480.570:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.438377][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 27.438912][ T24] audit: type=1400 audit(1785695480.570:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.503889][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.865576][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 27.876600][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 28.404196][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.411311][ T334] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.418964][ T334] device bridge_slave_0 entered promiscuous mode [ 28.425971][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.433155][ T334] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.440704][ T334] device bridge_slave_1 entered promiscuous mode [ 28.484842][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.491953][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.499423][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.506537][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.526035][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.533918][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.541724][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.550737][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.559260][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.566837][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.578435][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.586758][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.593841][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.605965][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.615386][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.629477][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.640869][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.649342][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.656847][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.665125][ T334] device veth0_vlan entered promiscuous mode [ 28.675691][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.689137][ T334] device veth1_macvtap entered promiscuous mode [ 28.698566][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.708927][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/08/02 18:31:22 executed programs: 0 [ 29.190379][ T382] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.197670][ T382] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.205061][ T382] device bridge_slave_0 entered promiscuous mode [ 29.213188][ T382] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.220384][ T382] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.228245][ T382] device bridge_slave_1 entered promiscuous mode [ 29.276121][ T382] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.283393][ T382] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.291291][ T382] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.298388][ T382] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.317106][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.325712][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.334601][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.344211][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.352491][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.359576][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.369103][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.377805][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.385036][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.396336][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 29.404592][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.414929][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.423131][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.435984][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.444683][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.456664][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.465383][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.473675][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.481579][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.497778][ T382] device veth0_vlan entered promiscuous mode [ 29.507872][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 29.516204][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.530913][ T382] device veth1_macvtap entered promiscuous mode [ 29.540253][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 29.548094][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.556443][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.566593][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.575007][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.668268][ T390] ================================================================== [ 29.676441][ T390] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 29.683331][ T390] Write of size 8 at addr ffff8881114a1550 by task syz.2.17/390 [ 29.690991][ T390] [ 29.693357][ T390] CPU: 0 PID: 390 Comm: syz.2.17 Not tainted syzkaller #0 [ 29.700495][ T390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 29.710567][ T390] Call Trace: [ 29.713884][ T390] __dump_stack+0x21/0x24 [ 29.718476][ T390] dump_stack_lvl+0x1a7/0x208 [ 29.723206][ T390] ? show_regs_print_info+0x18/0x18 [ 29.728530][ T390] ? thaw_kernel_threads+0x220/0x220 [ 29.733841][ T390] print_address_description+0x7f/0x2c0 [ 29.739406][ T390] ? mutex_lock+0x85/0xf0 [ 29.743758][ T390] kasan_report+0x100/0x140 [ 29.748402][ T390] ? mutex_lock+0x85/0xf0 [ 29.752758][ T390] kasan_check_range+0x249/0x2a0 [ 29.757883][ T390] __kasan_check_write+0x14/0x20 [ 29.762862][ T390] mutex_lock+0x85/0xf0 [ 29.767057][ T390] ? mutex_trylock+0xb0/0xb0 [ 29.771721][ T390] ? l2tp_session_put+0xb2/0x1a0 [ 29.776809][ T390] ? l2tp_session_delete+0x3a9/0x4a0 [ 29.782490][ T390] pppol2tp_release+0x178/0x2b0 [ 29.787370][ T390] sock_close+0xb8/0x200 [ 29.791660][ T390] ? sock_mmap+0xa0/0xa0 [ 29.795922][ T390] __fput+0x2dc/0x730 [ 29.799945][ T390] ____fput+0x15/0x20 [ 29.803951][ T390] task_work_run+0x127/0x190 [ 29.808563][ T390] do_exit+0xa7c/0x24e0 [ 29.812766][ T390] ? finish_task_switch+0x1b7/0x5a0 [ 29.818005][ T390] ? put_task_struct+0x90/0x90 [ 29.822795][ T390] ? remove_hrtimer+0x225/0x490 [ 29.827669][ T390] ? __kasan_check_write+0x14/0x20 [ 29.832809][ T390] ? _raw_spin_lock_irq+0x95/0xf0 [ 29.837864][ T390] do_group_exit+0x149/0x310 [ 29.842485][ T390] ? __kasan_check_write+0x14/0x20 [ 29.847613][ T390] ? recalc_sigpending+0x1c4/0x230 [ 29.852748][ T390] get_signal+0xfb1/0x1300 [ 29.857369][ T390] arch_do_signal_or_restart+0xe7/0x11b0 [ 29.863020][ T390] ? nanosleep_copyout+0x120/0x120 [ 29.868154][ T390] ? get_timespec64+0x116/0x1b0 [ 29.873034][ T390] ? __ia32_sys_rt_sigreturn+0x730/0x730 [ 29.878807][ T390] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 29.884460][ T390] ? debug_smp_processor_id+0x17/0x20 [ 29.889861][ T390] exit_to_user_mode_loop+0xa2/0xe0 [ 29.895091][ T390] exit_to_user_mode_prepare+0x76/0xa0 [ 29.900727][ T390] syscall_exit_to_user_mode+0x1d/0x40 [ 29.906223][ T390] do_syscall_64+0x3d/0x40 [ 29.910784][ T390] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.919258][ T390] RIP: 0033:0x7f49b5e1584e [ 29.923697][ T390] Code: Unable to access opcode bytes at RIP 0x7f49b5e15824. [ 29.931094][ T390] RSP: 002b:00007f49b5cb5e78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 29.939531][ T390] RAX: fffffffffffffdfc RBX: 00007f49b5cb66c0 RCX: 00007f49b5e1584e [ 29.947538][ T390] RDX: 00007f49b5cb5ed0 RSI: 0000000000000000 RDI: 0000000000000000 [ 29.955552][ T390] RBP: 00007f49b5eec00c R08: 0000000000000000 R09: 0000000000000000 [ 29.963619][ T390] R10: 0000000000000000 R11: 0000000000000246 R12