Warning: Permanently added '10.128.0.108' (ED25519) to the list of known hosts. 2026/08/03 12:58:37 parsed 1 programs 2026/08/03 12:58:37 serving rpc on tcp://44139 [ 20.253981][ T28] audit: type=1400 audit(1785761917.989:64): avc: denied { node_bind } for pid=294 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 20.275501][ T28] audit: type=1400 audit(1785761917.989:65): avc: denied { module_request } for pid=294 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 21.025223][ T28] audit: type=1400 audit(1785761918.759:66): avc: denied { mounton } for pid=300 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.026306][ T300] cgroup: Unknown subsys name 'net' [ 21.048673][ T28] audit: type=1400 audit(1785761918.759:67): avc: denied { mount } for pid=300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.078083][ T28] audit: type=1400 audit(1785761918.789:68): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.078355][ T300] cgroup: Unknown subsys name 'devices' [ 21.192131][ T300] cgroup: Unknown subsys name 'hugetlb' [ 21.197808][ T300] cgroup: Unknown subsys name 'rlimit' [ 21.335803][ T28] audit: type=1400 audit(1785761919.069:69): avc: denied { setattr } for pid=300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.359587][ T28] audit: type=1400 audit(1785761919.069:70): avc: denied { create } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.368630][ T304] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.380475][ T28] audit: type=1400 audit(1785761919.069:71): avc: denied { write } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.409134][ T28] audit: type=1400 audit(1785761919.069:72): avc: denied { read } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.422461][ T300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.430212][ T28] audit: type=1400 audit(1785761919.069:73): avc: denied { mounton } for pid=300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.095602][ T306] request_module fs-gadgetfs succeeded, but still no fs? [ 22.178579][ T311] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.186047][ T311] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.193640][ T311] device bridge_slave_0 entered promiscuous mode [ 22.200951][ T311] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.208012][ T311] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.215460][ T311] device bridge_slave_1 entered promiscuous mode [ 22.251599][ T311] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.259035][ T311] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.266373][ T311] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.273687][ T311] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.292106][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.299814][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.307142][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.316548][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.325000][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.332057][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.341557][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.349779][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.356855][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.368813][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.381012][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.391795][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.402683][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.411187][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.419516][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.428632][ T311] device veth0_vlan entered promiscuous mode [ 22.438141][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.447421][ T311] device veth1_macvtap entered promiscuous mode [ 22.456392][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.467271][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/08/03 12:58:40 executed programs: 0 [ 23.271735][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.278793][ T370] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.286180][ T370] device bridge_slave_0 entered promiscuous mode [ 23.293392][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.300809][ T370] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.308239][ T370] device bridge_slave_1 entered promiscuous mode [ 23.346204][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.353362][ T370] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.360670][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.367680][ T370] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.375862][ T8] device bridge_slave_1 left promiscuous mode [ 23.382031][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.389476][ T8] device bridge_slave_0 left promiscuous mode [ 23.395862][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.404738][ T8] device veth1_macvtap left promiscuous mode [ 23.410938][ T8] device veth0_vlan left promiscuous mode [ 23.493435][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.501572][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.508776][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.517776][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.526089][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.533132][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.542074][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.551246][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.558363][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.571339][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.580807][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.594060][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.604979][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.613097][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.621189][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.629195][ T370] device veth0_vlan entered promiscuous mode [ 23.639979][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.648948][ T370] device veth1_macvtap entered promiscuous mode [ 23.657876][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.667647][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.696241][ T374] ================================================================== [ 23.704331][ T374] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x9c/0xb0 [ 23.711960][ T374] Write of size 8 at addr ffff88811406d190 by task syz.2.17/374 [ 23.719658][ T374] [ 23.721975][ T374] CPU: 0 PID: 374 Comm: syz.2.17 Not tainted syzkaller #0 [ 23.729065][ T374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 23.739383][ T374] Call Trace: [ 23.742681][ T374] [ 23.745689][ T374] __dump_stack+0x21/0x24 [ 23.750121][ T374] dump_stack_lvl+0x110/0x170 [ 23.754838][ T374] ? __cfi_dump_stack_lvl+0x8/0x8 [ 23.759859][ T374] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 23.765153][ T374] print_address_description+0x71/0x200 [ 23.770690][ T374] print_report+0x4a/0x60 [ 23.774996][ T374] kasan_report+0x122/0x150 [ 23.779493][ T374] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 23.784850][ T374] __asan_report_store8_noabort+0x17/0x20 [ 23.790581][ T374] rcu_segcblist_enqueue+0x9c/0xb0 [ 23.795683][ T374] call_rcu+0x554/0xf50 [ 23.799817][ T374] ? __cfi_call_rcu+0x10/0x10 [ 23.804471][ T374] ? __kasan_check_write+0x14/0x20 [ 23.809564][ T374] ? selinux_inode_free_security+0x21f/0x230 [ 23.815537][ T374] security_inode_free+0xc5/0xe0 [ 23.820458][ T374] __destroy_inode+0x175/0x500 [ 23.825473][ T374] evict+0x777/0x8c0 [ 23.829357][ T374] ? proc_nr_inodes+0x2f0/0x2f0 [ 23.834559][ T374] ? _raw_spin_lock+0x94/0xf0 [ 23.839252][ T374] ? __cfi__raw_spin_lock+0x10/0x10 [ 23.844435][ T374] ? __kasan_check_write+0x14/0x20 [ 23.849541][ T374] iput+0x633/0x690 [ 23.853340][ T374] dentry_unlink_inode+0x346/0x3f0 [ 23.858456][ T374] __dentry_kill+0x46c/0x680 [ 23.863027][ T374] dentry_kill+0xc0/0x2a0 [ 23.868041][ T374] dput+0x42/0x80 [ 23.871670][ T374] __fput+0x5c0/0x8f0 [ 23.875649][ T374] ____fput+0x15/0x20 [ 23.879638][ T374] task_work_run+0x1e1/0x250 [ 23.884212][ T374] ? __cfi_task_work_run+0x10/0x10 [ 23.889506][ T374] ? __cfi___close_range+0x10/0x10 [ 23.894604][ T374] exit_to_user_mode_loop+0x9b/0xb0 [ 23.899789][ T374] exit_to_user_mode_prepare+0x87/0xd0 [ 23.905226][ T374] syscall_exit_to_user_mode+0x1a/0x30 [ 23.910663][ T374] do_syscall_64+0x58/0xa0 [ 23.915075][ T374] ? clear_bhb_loop+0x30/0x80 [ 23.919921][ T374] ? clear_bhb_loop+0x30/0x80 [ 23.924608][ T374] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 23.930503][ T374] RIP: 0033:0x7fda7bb9e019 [ 23.934931][ T374] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 23.954586][ T374] RSP: 002b:00007ffdf2bf7f68 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 23.963030][ T374] RAX: 0000000000000000 RBX: 00007ffdf2bf8050 RCX: 00007fda7bb9e019 [ 23.970991][ T374] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 23.978967][ T374] RBP: 0000000000005c7a R08: 0000000000000001 R09: 0000000000000000 [ 23.987018][ T374] R10: 0000001b33020000 R11: 0000000000000246 R12: 0000000000000000 [ 23.995005][ T374] R13: 00007fda7be25fac R14: 00007fda7be25fa8 R15: 00007fda7be25fa0 [ 24.002970][ T374] [ 24.005976][ T374] [ 24.008273][ T374] Allocated by task 374: [ 24.012676][ T374] kasan_set_track+0x4b/0x70 [ 24.017267][ T374] kasan_save_alloc_info+0x1f/0x30 [ 24.022352][ T374] __kasan_kmalloc+0x95/0xb0 [ 24.026927][ T374] __kmalloc+0xb4/0x1e0 [ 24.031057][ T374] l2tp_session_create+0x38/0xbd0 [ 24.036066][ T374] pppol2tp_connect+0xbf5/0x1640 [ 24.040988][ T374] __sys_connect+0x3da/0x460 [ 24.045564][ T374] __x64_sys_connect+0x7a/0x90 [ 24.050319][ T374] x64_sys_call+0x88d/0x9a0 [ 24.054808][ T374] do_syscall_64+0x4c/0xa0 [ 24.059199][ T374] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.065072][ T374] [ 24.067380][ T374] Freed by task 43: [ 24.071169][ T374] kasan_set_track+0x4b/0x70 [ 24.075748][ T374] kasan_save_free_info+0x2b/0x40 [ 24.080764][ T374] ____kasan_slab_free+0x132/0x180 [ 24.085861][ T374] __kasan_slab_free+0x11/0x20 [ 24.091130][ T374] slab_free_freelist_hook+0xc2/0x190 [ 24.096492][ T374] __kmem_cache_free+0xb7/0x1b0 [ 24.101345][ T374] kfree+0x6f/0xf0 [ 24.105050][ T374] l2tp_session_put+0xaf/0x1a0 [ 24.109949][ T374] l2tp_session_delete+0x3df/0x4d0 [ 24.115061][ T374] l2tp_tunnel_del_work+0x199/0x410 [ 24.120264][ T374] process_one_work+0x717/0xc30 [ 24.125364][ T374] worker_thread+0xa4d/0x11d0 [ 24.130142][ T374] kthread+0x281/0x320 [ 24.135421][ T374] ret_from_fork+0x1f/0x30 [ 24.139867][ T374] [ 24.142194][ T374] Last potentially related work creation: [ 24.147890][ T374] kasan_save_stack+0x3a/0x60 [ 24.152558][ T374] __kasan_record_aux_stack+0xb6/0xc0 [ 24.157920][ T374] kasan_record_aux_stack_noalloc+0xb/0x10 [ 24.164062][ T374] call_rcu+0xcf/0xf50 [ 24.168125][ T374] pppol2tp_release+0x1e3/0x2b0 [ 24.172978][ T374] sock_close+0xc9/0x220 [ 24.177300][ T374] __fput+0x1fd/0x8f0 [ 24.181452][ T374] ____fput+0x15/0x20 [ 24.185426][ T374] task_work_run+0x1e1/0x250 [ 24.190032][ T374] exit_to_user_mode_loop+0x9b/0xb0 [ 24.195570][ T374] exit_to_user_mode_prepare+0x87/0xd0 [ 24.201099][ T374] syscall_exit_to_user_mode+0x1a/0x30 [ 24.206539][ T374] do_syscall_64+0x58/0xa0 [ 24.210933][ T374] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.216914][ T374] [ 24.219225][ T374] The buggy address belongs to the object at ffff88811406d000 [ 24.219225][ T374] which belongs to the cache kmalloc-512 of size 512 [ 24.233269][ T374] The buggy address is located 400 bytes inside of [ 24.233269][ T374] 512-byte region [ffff88811406d000, ffff88811406d200) [ 24.246539][ T374] [ 24.248853][ T374] The buggy address belongs to the physical page: [ 24.255255][ T374] page:ffffea0004501b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11406c [ 24.265485][ T374] head:ffffea0004501b00 order:2 compound_mapcount:0 compound_pincount:0 [ 24.273888][ T374] flags: 0x4000000000010200(slab|head|zone=1) [ 24.279988][ T374] raw: 4000000000010200 ffffea0004520f00 dead000000000003 ffff888100042f00 [ 24.288585][ T374] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 24.297243][ T374] page dumped because: kasan: bad access detected [ 24.303643][ T374] page_owner tracks the page as allocated [ 24.309384][ T374] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 115, tgid 115 (udevd), ts 4683958431, free_ts 0 [ 24.329223][ T374] post_alloc_hook+0x1f5/0x210 [ 24.334077][ T374] prep_new_page+0x1c/0x110 [ 24.338659][ T374] get_page_from_freelist+0x2ca9/0x2d20 [ 24.344431][ T374] __alloc_pages+0x1fa/0x610 [ 24.349011][ T374] alloc_slab_page+0x6e/0xf0 [ 24.353587][ T374] new_slab+0x98/0x3e0 [ 24.357650][ T374] ___slab_alloc+0x70f/0xb70 [ 24.362581][ T374] __slab_alloc+0x5e/0xa0 [ 24.366892][ T374] __kmem_cache_alloc_node+0x204/0x2d0 [ 24.372332][ T374] __kmalloc_node_track_caller+0xa1/0x1e0 [ 24.378041][ T374] __alloc_skb+0x226/0x4a0 [ 24.382444][ T374] alloc_skb_with_frags+0xa8/0x620 [ 24.387536][ T374] sock_alloc_send_pskb+0x87f/0x9a0 [ 24.392717][ T374] unix_dgram_sendmsg+0x5c1/0x1710 [ 24.397825][ T374] sock_write_iter+0x2ea/0x3f0 [ 24.402565][ T374] vfs_write+0x5ef/0xd00 [ 24.406785][ T374] page_owner free stack trace missing [ 24.412128][ T374] [ 24.414434][ T374] Memory state around the buggy address: [ 24.420141][ T374] ffff88811406d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.428579][ T374] ffff88811406d100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.436658][ T374] >ffff88811406d180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.444708][ T374] ^ [ 24.449293][ T374] ffff88811406d200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.457701][ T374] ffff88811406d280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.465927][ T374] ================================================================== [ 24.474055][ T374] Disabling lock debugging due to kernel taint