syzkaller syzkaller login: [ 14.136249][ T24] kauditd_printk_skb: 31 callbacks suppressed [ 14.136258][ T24] audit: type=1400 audit(1790507716.780:59): avc: denied { transition } for pid=216 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.144104][ T24] audit: type=1400 audit(1790507716.780:60): avc: denied { noatsecure } for pid=216 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.150408][ T24] audit: type=1400 audit(1790507716.780:61): avc: denied { write } for pid=216 comm="sh" path="pipe:[14292]" dev="pipefs" ino=14292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.158145][ T24] audit: type=1400 audit(1790507716.780:62): avc: denied { rlimitinh } for pid=216 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.178889][ T24] audit: type=1400 audit(1790507716.780:63): avc: denied { siginh } for pid=216 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.23' (ED25519) to the list of known hosts. 2026/09/27 11:15:25 parsed 1 programs 2026/09/27 11:15:25 serving rpc on tcp://34661 [ 22.962295][ T24] audit: type=1400 audit(1790507725.600:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 22.983361][ T24] audit: type=1400 audit(1790507725.600:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 23.003517][ T24] audit: type=1400 audit(1790507725.600:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 23.623447][ T24] audit: type=1400 audit(1790507726.260:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.624622][ T293] cgroup: Unknown subsys name 'net' [ 23.646209][ T24] audit: type=1400 audit(1790507726.260:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.673619][ T24] audit: type=1400 audit(1790507726.290:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.673800][ T293] cgroup: Unknown subsys name 'devices' [ 23.786893][ T293] cgroup: Unknown subsys name 'hugetlb' [ 23.792709][ T293] cgroup: Unknown subsys name 'rlimit' [ 23.905680][ T24] audit: type=1400 audit(1790507726.550:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.929053][ T24] audit: type=1400 audit(1790507726.550:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.950763][ T24] audit: type=1400 audit(1790507726.550:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.972746][ T24] audit: type=1400 audit(1790507726.550:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.995202][ T298] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 24.114887][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.563693][ T301] request_module fs-gadgetfs succeeded, but still no fs? [ 24.572693][ T301] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 24.917479][ T337] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.924623][ T337] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.932299][ T337] device bridge_slave_0 entered promiscuous mode [ 24.939601][ T337] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.947110][ T337] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.954434][ T337] device bridge_slave_1 entered promiscuous mode [ 24.986477][ T337] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.993517][ T337] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.000922][ T337] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.007967][ T337] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.024145][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.032559][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.040422][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.059152][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.067405][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.074541][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.081903][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.091663][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.099231][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.107625][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.116758][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.125829][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.139679][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.147843][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.155713][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.163867][ T337] device veth0_vlan entered promiscuous mode [ 25.178356][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.187320][ T337] device veth1_macvtap entered promiscuous mode [ 25.196213][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.206091][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/09/27 11:15:28 executed programs: 0 [ 25.576345][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.583370][ T371] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.590757][ T371] device bridge_slave_0 entered promiscuous mode [ 25.597558][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.604872][ T371] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.613221][ T371] device bridge_slave_1 entered promiscuous mode [ 25.647578][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.655487][ T371] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.663039][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.670204][ T371] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.686605][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.694103][ T344] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.701479][ T344] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.710166][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.718451][ T344] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.725508][ T344] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.733937][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.742309][ T344] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.749389][ T344] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.760250][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.769421][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.781407][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.791895][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.800160][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.808060][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.816609][ T371] device veth0_vlan entered promiscuous mode [ 25.825724][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.834717][ T371] device veth1_macvtap entered promiscuous mode [ 25.843167][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.852933][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.935888][ T399] ================================================================== [ 25.943989][ T399] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 25.950666][ T399] Write of size 8 at addr ffff88811106e550 by task syz.2.17/399 [ 25.958357][ T399] [ 25.960681][ T399] CPU: 1 PID: 399 Comm: syz.2.17 Not tainted syzkaller #0 [ 25.967808][ T399] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.977844][ T399] Call Trace: [ 25.981201][ T399] __dump_stack+0x21/0x24 [ 25.985508][ T399] dump_stack_lvl+0x1a7/0x208 [ 25.990163][ T399] ? show_regs_print_info+0x18/0x18 [ 25.995424][ T399] ? thaw_kernel_threads+0x220/0x220 [ 26.000687][ T399] print_address_description+0x7f/0x2c0 [ 26.006474][ T399] ? mutex_lock+0x85/0xf0 [ 26.010968][ T399] kasan_report+0x100/0x140 [ 26.015452][ T399] ? mutex_lock+0x85/0xf0 [ 26.019876][ T399] kasan_check_range+0x249/0x2a0 [ 26.024803][ T399] __kasan_check_write+0x14/0x20 [ 26.029900][ T399] mutex_lock+0x85/0xf0 [ 26.034033][ T399] ? mutex_trylock+0xb0/0xb0 [ 26.038603][ T399] ? l2tp_session_put+0xb2/0x1a0 [ 26.043514][ T399] ? l2tp_session_delete+0x3a9/0x4a0 [ 26.048809][ T399] pppol2tp_release+0x178/0x2b0 [ 26.053666][ T399] sock_close+0xb8/0x200 [ 26.057887][ T399] ? sock_mmap+0xa0/0xa0 [ 26.062125][ T399] __fput+0x2dc/0x730 [ 26.066097][ T399] ____fput+0x15/0x20 [ 26.070069][ T399] task_work_run+0x127/0x190 [ 26.074642][ T399] do_exit+0xa7c/0x24e0 [ 26.078796][ T399] ? finish_task_switch+0x1e2/0x5a0 [ 26.084346][ T399] ? put_task_struct+0x90/0x90 [ 26.089103][ T399] ? remove_hrtimer+0x225/0x490 [ 26.094836][ T399] ? __kasan_check_write+0x14/0x20 [ 26.102333][ T399] ? _raw_spin_lock_irq+0x95/0xf0 [ 26.107709][ T399] do_group_exit+0x149/0x310 [ 26.112368][ T399] ? __kasan_check_write+0x14/0x20 [ 26.117470][ T399] ? recalc_sigpending+0x1c4/0x230 [ 26.122665][ T399] get_signal+0xfb1/0x1300 [ 26.127160][ T399] arch_do_signal_or_restart+0xe7/0x11b0 [ 26.132864][ T399] ? nanosleep_copyout+0x120/0x120 [ 26.137972][ T399] ? get_timespec64+0x116/0x1b0 [ 26.142915][ T399] ? __ia32_sys_rt_sigreturn+0x730/0x730 [ 26.148544][ T399] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 26.154168][ T399] ? debug_smp_processor_id+0x17/0x20 [ 26.159627][ T399] exit_to_user_mode_loop+0xa2/0xe0 [ 26.164803][ T399] exit_to_user_mode_prepare+0x76/0xa0 [ 26.170520][ T399] syscall_exit_to_user_mode+0x1d/0x40 [ 26.176074][ T399] do_syscall_64+0x3d/0x40 [ 26.180920][ T399] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.186790][ T399] RIP: 0033:0x7f732e1472d7 [ 26.191179][ T399] Code: Unable to access opcode bytes at RIP 0x7f732e1472ad. [ 26.198605][ T399] RSP: 002b:00007ffeb0f29730 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 26.207008][ T399] RAX: fffffffffffffdfc RBX: 000055557c6cc500 RCX: 00007f732e1472d7 [ 26.214961][ T399] RDX: 00007ffeb0f29770 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.223031][ T399] RBP: 00007f732e22306b R08: 0000000000000000 R09: 0000000000000000 [ 26.231076][ T399] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 26.239027][ T399] R13: 00007f732e413fac R14: 00007f732e413fa0 R15: 00007f732e413fa0 [ 26.246975][ T399] [ 26.249304][ T399] Allocated by task 398: [ 26.253621][ T399] __kasan_kmalloc+0xd4/0x100 [ 26.258277][ T399] __kmalloc+0x19f/0x330 [ 26.262495][ T399] l2tp_session_create+0x39/0xb60 [ 26.267598][ T399] pppol2tp_connect+0xbf5/0x1640 [ 26.273204][ T399] __sys_connect+0x3ce/0x450 [ 26.277786][ T399] __x64_sys_connect+0x7a/0x90 [ 26.282749][ T399] do_syscall_64+0x31/0x40 [ 26.287155][ T399] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.293768][ T399] [ 26.296084][ T399] Freed by task 399: [ 26.299990][ T399] kasan_set_track+0x4a/0x70 [ 26.304556][ T399] kasan_set_free_info+0x23/0x40 [ 26.309481][ T399] ____kasan_slab_free+0x125/0x160 [ 26.314570][ T399] __kasan_slab_free+0x11/0x20 [ 26.319519][ T399] slab_free_freelist_hook+0xc5/0x190 [ 26.324902][ T399] kfree+0xc0/0x270 [ 26.328692][ T399] l2tp_session_put+0xb2/0x1a0 [ 26.333431][ T399] l2tp_session_delete+0x3a9/0x4a0 [ 26.338633][ T399] pppol2tp_release+0x169/0x2b0 [ 26.343469][ T399] sock_close+0xb8/0x200 [ 26.347697][ T399] __fput+0x2dc/0x730 [ 26.351659][ T399] ____fput+0x15/0x20 [ 26.355624][ T399] task_work_run+0x127/0x190 [ 26.360193][ T399] do_exit+0xa7c/0x24e0 [ 26.364329][ T399] do_group_exit+0x149/0x310 [ 26.368925][ T399] get_signal+0xfb1/0x1300 [ 26.373583][ T399] arch_do_signal_or_restart+0xe7/0x11b0 [ 26.379192][ T399] exit_to_user_mode_loop+0xa2/0xe0 [ 26.384388][ T399] exit_to_user_mode_prepare+0x76/0xa0 [ 26.389827][ T399] syscall_exit_to_user_mode+0x1d/0x40 [ 26.395262][ T399] do_syscall_64+0x3d/0x40 [ 26.399669][ T399] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.405536][ T399] [ 26.407863][ T399] The buggy address belongs to the object at ffff88811106e400 [ 26.407863][ T399] which belongs to the cache kmalloc-512 of size 512 [ 26.421930][ T399] The buggy address is located 336 bytes inside of [ 26.421930][ T399] 512-byte region [ffff88811106e400, ffff88811106e600) [ 26.435366][ T399] The buggy address belongs to the page: [ 26.441011][ T399] page:ffffea0004441b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11106c [ 26.451241][ T399] head:ffffea0004441b00 order:2 compound_mapcount:0 compound_pincount:0 [ 26.459733][ T399] flags: 0x4000000000010200(slab|head) [ 26.465263][ T399] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 26.473849][ T399] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 26.482427][ T399] page dumped because: kasan: bad access detected [ 26.488817][ T399] page_owner tracks the page as allocated [ 26.494534][ T399] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 371, ts 25872002099, free_ts 25863821305 [ 26.515083][ T399] prep_new_page+0x176/0x190 [ 26.519651][ T399] get_page_from_freelist+0x225f/0x23f0 [ 26.525197][ T399] __alloc_pages_nodemask+0x29a/0x640 [ 26.530553][ T399] new_slab+0x84/0x3f0 [ 26.534597][ T399] ___slab_alloc+0x2f8/0x4c0 [ 26.539266][ T399] __slab_alloc+0x63/0xa0 [ 26.543660][ T399] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 26.549011][ T399] alloc_fair_sched_group+0x1ba/0x6d0 [ 26.554445][ T399] sched_create_group+0x42/0x230 [ 26.559358][ T399] cpu_cgroup_css_alloc+0xe/0x30 [ 26.564278][ T399] cgroup_apply_control_enable+0x338/0x12b0 [ 26.570150][ T399] cgroup_mkdir+0x143c/0x16d0 [ 26.574819][ T399] kernfs_iop_mkdir+0x1a3/0x2b0 [ 26.579651][ T399] vfs_mkdir+0x42c/0x600 [ 26.584331][ T399] do_mkdirat+0x14c/0x340 [ 26.588639][ T399] __x64_sys_mkdirat+0x7b/0x90 [ 26.593464][ T399] page last free stack trace: [ 26.598120][ T399] __free_pages_ok+0x80b/0x830 [ 26.602863][ T399] __free_pages+0xd8/0x390 [ 26.607435][ T399] __free_slab+0xcf/0x190 [ 26.612037][ T399] unfreeze_partials+0x150/0x180 [ 26.616973][ T399] put_cpu_partial+0xc1/0x180 [ 26.621641][ T399] __slab_free+0x2c9/0x3a0 [ 26.626198][ T399] ___cache_free+0x10e/0x130 [ 26.631165][ T399] qlink_free+0x50/0x90 [ 26.635479][ T399] qlist_free_all+0x5f/0xb0 [ 26.639963][ T399] kasan_quarantine_reduce+0x14a/0x160 [ 26.645396][ T399] __kasan_slab_alloc+0x2f/0xe0 [ 26.650260][ T399] slab_post_alloc_hook+0x5d/0x2f0 [ 26.655354][ T399] kmem_cache_alloc+0x15a/0x2d0 [ 26.660181][ T399] __alloc_skb+0x9e/0x520 [ 26.664484][ T399] inet_netconf_notify_devconf+0x169/0x220 [ 26.670300][ T399] inetdev_event+0x7b0/0x1010 [ 26.674945][ T399] [ 26.677258][ T399] Memory state around the buggy address: [ 26.683056][ T399] ffff88811106e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.691179][ T399] ffff88811106e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.699306][ T399] >ffff88811106e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.707343][ T399] ^ [ 26.713988][ T399] ffff88811106e580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.723097][ T399] ffff88811106e600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.731155][ T399] ================================================================== [