syzkaller syzkaller login: [ 14.204894][ T28] kauditd_printk_skb: 31 callbacks suppressed [ 14.204910][ T28] audit: type=1400 audit(1784864072.857:59): avc: denied { transition } for pid=224 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.210026][ T28] audit: type=1400 audit(1784864072.857:60): avc: denied { noatsecure } for pid=224 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.213810][ T28] audit: type=1400 audit(1784864072.877:61): avc: denied { write } for pid=224 comm="sh" path="pipe:[14471]" dev="pipefs" ino=14471 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.217757][ T28] audit: type=1400 audit(1784864072.877:62): avc: denied { rlimitinh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.220909][ T28] audit: type=1400 audit(1784864072.877:63): avc: denied { siginh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.117' (ED25519) to the list of known hosts. 2026/07/24 03:34:42 parsed 1 programs 2026/07/24 03:34:42 serving rpc on tcp://45023 [ 24.015154][ T28] audit: type=1400 audit(1784864082.667:64): avc: denied { node_bind } for pid=294 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.036154][ T28] audit: type=1400 audit(1784864082.667:65): avc: denied { module_request } for pid=294 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.201200][ T28] audit: type=1400 audit(1784864083.857:66): avc: denied { mounton } for pid=300 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.204459][ T300] cgroup: Unknown subsys name 'net' [ 25.223891][ T28] audit: type=1400 audit(1784864083.857:67): avc: denied { mount } for pid=300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.251259][ T28] audit: type=1400 audit(1784864083.897:68): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.251829][ T300] cgroup: Unknown subsys name 'devices' [ 25.369079][ T300] cgroup: Unknown subsys name 'hugetlb' [ 25.374814][ T300] cgroup: Unknown subsys name 'rlimit' [ 25.488180][ T28] audit: type=1400 audit(1784864084.147:69): avc: denied { setattr } for pid=300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.511385][ T28] audit: type=1400 audit(1784864084.147:70): avc: denied { create } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.531800][ T28] audit: type=1400 audit(1784864084.147:71): avc: denied { write } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.552102][ T28] audit: type=1400 audit(1784864084.147:72): avc: denied { read } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.572422][ T28] audit: type=1400 audit(1784864084.147:73): avc: denied { mounton } for pid=300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.583156][ T304] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.634940][ T300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.418002][ T310] request_module fs-gadgetfs succeeded, but still no fs? [ 26.725965][ T329] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.733082][ T329] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.740704][ T329] device bridge_slave_0 entered promiscuous mode [ 26.747751][ T329] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.754814][ T329] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.762284][ T329] device bridge_slave_1 entered promiscuous mode [ 26.787417][ T325] syz-executor (325) used greatest stack depth: 22496 bytes left [ 26.814005][ T329] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.821092][ T329] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.828424][ T329] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.835467][ T329] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.857776][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.865452][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.873099][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.882238][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.890997][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.898105][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.907285][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.915515][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.922588][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.936277][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.945467][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.960035][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.971398][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.979580][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.987243][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.995551][ T329] device veth0_vlan entered promiscuous mode [ 27.006652][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.015809][ T329] device veth1_macvtap entered promiscuous mode [ 27.025360][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.035756][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/24 03:34:46 executed programs: 0 [ 27.710013][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.717246][ T371] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.725012][ T371] device bridge_slave_0 entered promiscuous mode [ 27.732635][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.739748][ T371] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.747473][ T371] device bridge_slave_1 entered promiscuous mode [ 27.794659][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.801734][ T371] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.809084][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.816128][ T371] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.836477][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.843896][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.851425][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.859188][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.868285][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.876503][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.883575][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.892701][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.900991][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.908057][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.920710][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.930193][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.944879][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.956492][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.964714][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.972491][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.980847][ T371] device veth0_vlan entered promiscuous mode [ 27.991531][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.000695][ T371] device veth1_macvtap entered promiscuous mode [ 28.010220][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.020639][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.097750][ T376] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 28.109493][ T376] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 28.117915][ T376] CPU: 0 PID: 376 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.125050][ T376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 28.135118][ T376] RIP: 0010:step_into+0x113/0xf00 [ 28.140181][ T376] Code: 8d 73 38 c6 44 24 5f 00 43 0f b6 04 3c 84 c0 4d 89 fd 0f 85 eb 0b 00 00 45 8b 36 4c 8b bc 24 88 00 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 ea 0b 00 00 45 8b 3f 44 89 fe 81 e6 00 [ 28.159800][ T376] RSP: 0018:ffffc90000a17a20 EFLAGS: 00010247 [ 28.165883][ T376] RAX: 0000000000000000 RBX: ffffc90000a17c20 RCX: ffff888114b35100 [ 28.173872][ T376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.181848][ T376] RBP: ffffc90000a17b18 R08: ffff888123d5e6e7 R09: 1ffff110247abcdc [ 28.189849][ T376] R10: dffffc0000000000 R11: ffffed10247abcdd R12: 1ffff92000142f8b [ 28.197825][ T376] R13: dffffc0000000000 R14: 0000000000004000 R15: 0000000000000007 [ 28.205803][ T376] FS: 00007f8aa30096c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 28.214738][ T376] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.221334][ T376] CR2: 0000200000006dc0 CR3: 000000010f143000 CR4: 00000000003506b0 [ 28.229328][ T376] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.237321][ T376] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.245314][ T376] Call Trace: [ 28.248626][ T376] [ 28.251559][ T376] ? down_read+0xa6/0xf0 [ 28.255814][ T376] ? set_root+0x400/0x400 [ 28.260183][ T376] ? up_read+0x56/0x1d0 [ 28.264361][ T376] walk_component+0x245/0x430 [ 28.269077][ T376] path_lookupat+0x155/0x430 [ 28.273677][ T376] filename_lookup+0x229/0x580 [ 28.278448][ T376] ? __cfi_filename_lookup+0x10/0x10 [ 28.283741][ T376] ? strncpy_from_user+0x172/0x2c0 [ 28.288879][ T376] ? getname_flags+0x205/0x510 [ 28.293647][ T376] user_path_at_empty+0x46/0x1c0 [ 28.298612][ T376] do_readlinkat+0xd9/0x490 [ 28.303127][ T376] ? xfd_validate_state+0x70/0x150 [ 28.308250][ T376] ? cp_old_stat+0x4a0/0x4a0 [ 28.312860][ T376] ? fpregs_restore_userregs+0x128/0x260 [ 28.318500][ T376] __x64_sys_readlink+0x7f/0x90 [ 28.323362][ T376] x64_sys_call+0x87f/0x9a0 [ 28.327871][ T376] do_syscall_64+0x4c/0xa0 [ 28.332305][ T376] ? clear_bhb_loop+0x30/0x80 [ 28.337013][ T376] ? clear_bhb_loop+0x30/0x80 [ 28.341699][ T376] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.347635][ T376] RIP: 0033:0x7f8aa219de99 [ 28.352086][ T376] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.371735][ T376] RSP: 002b:00007f8aa3009028 EFLAGS: 00000246 ORIG_RAX: 0000000000000059 [ 28.380158][ T376] RAX: ffffffffffffffda RBX: 00007f8aa2425fa0 RCX: 00007f8aa219de99 [ 28.388143][ T376] RDX: 000000000000009f RSI: 00002000000023c0 RDI: 00002000000021c0 [ 28.396118][ T376] RBP: 00007f8aa2233eaf R08: 0000000000000000 R09: 0000000000000000 [ 28.404093][ T376] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.412071][ T376] R13: 00007f8aa2426038 R14: 00007f8aa2425fa0 R15: 00007ffc28141408 [ 28.420055][ T376] [ 28.423075][ T376] Modules linked in: [ 28.430289][ T376] ---[ end trace 0000000000000000 ]--- [ 28.435830][ T376] RIP: 0010:step_into+0x113/0xf00 [ 28.441339][ T376] Code: 8d 73 38 c6 44 24 5f 00 43 0f b6 04 3c 84 c0 4d 89 fd 0f 85 eb 0b 00 00 45 8b 36 4c 8b bc 24 88 00 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 ea 0b 00 00 45 8b 3f 44 89 fe 81 e6 00 [ 28.461147][ T376] RSP: 0018:ffffc90000a17a20 EFLAGS: 00010247 [ 28.468411][ T376] RAX: 0000000000000000 RBX: ffffc90000a17c20 RCX: ffff888114b35100 [ 28.476499][ T376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.484779][ T376] RBP: ffffc90000a17b18 R08: ffff888123d5e6e7 R09: 1ffff110247abcdc [ 28.493188][ T376] R10: dffffc0000000000 R11: ffffed10247abcdd R12: 1ffff92000142f8b [ 28.501444][ T376] R13: dffffc0000000000 R14: 0000000000004000 R15: 0000000000000007 [ 28.509644][ T376] FS: 00007f8aa30096c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 28.518771][ T376] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.525471][ T376] CR2: 0000200000006dc0 CR3: 000000010f143000 CR4: 00000000003506b0 [ 28.533555][ T376] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.541835][ T376] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.549905][ T376] Kernel panic - not syncing: Fatal exception [ 28.556146][ T376] Kernel Offset: disabled [ 28.560508][ T376] Rebooting in 86400 seconds..