Warning: Permanently added '10.128.1.48' (ED25519) to the list of known hosts. 2026/09/23 20:55:13 parsed 1 programs 2026/09/23 20:55:13 serving rpc on tcp://46655 [ 20.321850][ T30] audit: type=1400 audit(1790196913.789:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 20.325268][ T30] audit: type=1400 audit(1790196913.789:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 20.926653][ T30] audit: type=1400 audit(1790196914.389:66): avc: denied { mounton } for pid=299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.927713][ T299] cgroup: Unknown subsys name 'net' [ 20.949322][ T30] audit: type=1400 audit(1790196914.389:67): avc: denied { mount } for pid=299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.976568][ T30] audit: type=1400 audit(1790196914.429:68): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.976717][ T299] cgroup: Unknown subsys name 'devices' [ 21.090989][ T299] cgroup: Unknown subsys name 'hugetlb' [ 21.096601][ T299] cgroup: Unknown subsys name 'rlimit' [ 21.227078][ T30] audit: type=1400 audit(1790196914.689:69): avc: denied { setattr } for pid=299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.250257][ T30] audit: type=1400 audit(1790196914.689:70): avc: denied { create } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.270676][ T30] audit: type=1400 audit(1790196914.689:71): avc: denied { write } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.276237][ T303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.290928][ T30] audit: type=1400 audit(1790196914.689:72): avc: denied { read } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.319734][ T30] audit: type=1400 audit(1790196914.689:73): avc: denied { mounton } for pid=299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.350238][ T299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.781834][ T306] request_module fs-gadgetfs succeeded, but still no fs? [ 22.156317][ T346] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.163393][ T346] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.170886][ T346] device bridge_slave_0 entered promiscuous mode [ 22.177627][ T346] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.184708][ T346] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.192210][ T346] device bridge_slave_1 entered promiscuous mode [ 22.225627][ T346] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.232670][ T346] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.240025][ T346] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.247040][ T346] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.262823][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.270573][ T325] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.277686][ T325] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.292834][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.301090][ T325] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.308109][ T325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.315494][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.323852][ T325] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.330877][ T325] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.338288][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.352266][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.361606][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.372103][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.380172][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.387550][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.395723][ T346] device veth0_vlan entered promiscuous mode [ 22.405644][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.414491][ T346] device veth1_macvtap entered promiscuous mode [ 22.422808][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.433492][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.463016][ T346] syz-executor (346) used greatest stack depth: 22056 bytes left 2026/09/23 20:55:16 executed programs: 0 [ 22.705000][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.712139][ T367] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.719377][ T367] device bridge_slave_0 entered promiscuous mode [ 22.726139][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.733187][ T367] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.740656][ T367] device bridge_slave_1 entered promiscuous mode [ 22.778473][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.785527][ T367] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.792792][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.799829][ T367] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.819757][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.827314][ T325] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.834555][ T325] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.843626][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.851970][ T325] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.859022][ T325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.867516][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.875851][ T325] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.882891][ T325] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.900254][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.909142][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.921938][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.935917][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.943817][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.951186][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.959198][ T367] device veth0_vlan entered promiscuous mode [ 22.968361][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.981218][ T367] device veth1_macvtap entered promiscuous mode [ 22.989791][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.000595][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.110018][ T372] ================================================================== [ 23.118103][ T372] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 [ 23.124886][ T372] Write of size 8 at addr ffff88812e406150 by task syz.2.17/372 [ 23.132496][ T372] [ 23.134810][ T372] CPU: 0 PID: 372 Comm: syz.2.17 Not tainted syzkaller #0 [ 23.141898][ T372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 23.151941][ T372] Call Trace: [ 23.155204][ T372] [ 23.158117][ T372] __dump_stack+0x21/0x30 [ 23.162429][ T372] dump_stack_lvl+0x110/0x170 [ 23.167090][ T372] ? show_regs_print_info+0x20/0x20 [ 23.172268][ T372] ? load_image+0x3f0/0x3f0 [ 23.176752][ T372] print_address_description+0x7f/0x2c0 [ 23.182275][ T372] ? mutex_lock+0x8e/0x1c0 [ 23.186671][ T372] kasan_report+0x10f/0x150 [ 23.191155][ T372] ? mutex_lock+0x8e/0x1c0 [ 23.195553][ T372] kasan_check_range+0x249/0x2a0 [ 23.200468][ T372] __kasan_check_write+0x14/0x20 [ 23.205386][ T372] mutex_lock+0x8e/0x1c0 [ 23.209611][ T372] ? wait_for_completion_killable_timeout+0x10/0x10 [ 23.216181][ T372] ? l2tp_session_put+0xaf/0x1a0 [ 23.221106][ T372] ? l2tp_session_delete+0x3a9/0x4a0 [ 23.226386][ T372] pppol2tp_release+0x178/0x2b0 [ 23.231217][ T372] sock_close+0xb8/0x200 [ 23.235442][ T372] ? sock_mmap+0xa0/0xa0 [ 23.239666][ T372] __fput+0x22b/0x900 [ 23.243631][ T372] ____fput+0x15/0x20 [ 23.247613][ T372] task_work_run+0x127/0x190 [ 23.252187][ T372] do_exit+0xb70/0x29a0 [ 23.256326][ T372] ? finish_task_switch+0x209/0x790 [ 23.261509][ T372] ? put_task_struct+0x90/0x90 [ 23.266251][ T372] ? __remove_hrtimer+0x14d/0x3d0 [ 23.271259][ T372] ? __kasan_check_write+0x14/0x20 [ 23.276355][ T372] ? _raw_spin_lock_irq+0x95/0xf0 [ 23.281366][ T372] do_group_exit+0x149/0x310 [ 23.285935][ T372] ? __kasan_check_write+0x14/0x20 [ 23.291025][ T372] ? recalc_sigpending+0x1c4/0x230 [ 23.296117][ T372] get_signal+0x64f/0x1430 [ 23.300514][ T372] ? usleep_range_state+0x130/0x130 [ 23.305700][ T372] arch_do_signal_or_restart+0xe2/0x1100 [ 23.311313][ T372] ? nanosleep_copyout+0x120/0x120 [ 23.316410][ T372] ? __remove_hrtimer+0x3d0/0x3d0 [ 23.321413][ T372] ? get_timespec64+0x116/0x1b0 [ 23.326253][ T372] ? get_sigframe_size+0x10/0x10 [ 23.331188][ T372] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 23.336818][ T372] exit_to_user_mode_loop+0xa7/0xe0 [ 23.342006][ T372] exit_to_user_mode_prepare+0x87/0xd0 [ 23.347450][ T372] syscall_exit_to_user_mode+0x1a/0x30 [ 23.352900][ T372] do_syscall_64+0x58/0xa0 [ 23.357297][ T372] ? clear_bhb_loop+0x50/0xa0 [ 23.361954][ T372] ? clear_bhb_loop+0x50/0xa0 [ 23.366634][ T372] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 23.372509][ T372] RIP: 0033:0x7f16d64c82d7 [ 23.376905][ T372] Code: Unable to access opcode bytes at RIP 0x7f16d64c82ad. [ 23.384247][ T372] RSP: 002b:00007fff96343300 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 23.392640][ T372] RAX: fffffffffffffdfc RBX: 000055558f921500 RCX: 00007f16d64c82d7 [ 23.400594][ T372] RDX: 00007fff96343340 RSI: 0000000000000000 RDI: 0000000000000000 [ 23.408549][ T372] RBP: 00007f16d65a406b R08: 0000000000000000 R09: 0000000000000000 [ 23.416497][ T372] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 23.424447][ T372] R13: 00007f16d6794fac R14: 00007f16d6794fa0 R15: 00007f16d6794fa0 [ 23.432402][ T372] [ 23.435403][ T372] [ 23.437725][ T372] Allocated by task 371: [ 23.441941][ T372] __kasan_kmalloc+0xd4/0x100 [ 23.446602][ T372] __kmalloc+0x13d/0x2c0 [ 23.450824][ T372] l2tp_session_create+0x39/0xb60 [ 23.455828][ T372] pppol2tp_connect+0xbf5/0x1640 [ 23.460743][ T372] __sys_connect+0x3cb/0x450 [ 23.465312][ T372] __x64_sys_connect+0x7a/0x90 [ 23.470050][ T372] x64_sys_call+0x7c/0x9a0 [ 23.474446][ T372] do_syscall_64+0x4c/0xa0 [ 23.478839][ T372] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 23.484715][ T372] [ 23.487020][ T372] Freed by task 372: [ 23.490889][ T372] kasan_set_track+0x4a/0x70 [ 23.495455][ T372] kasan_set_free_info+0x23/0x40 [ 23.500370][ T372] ____kasan_slab_free+0x125/0x160 [ 23.505468][ T372] __kasan_slab_free+0x11/0x20 [ 23.510224][ T372] slab_free_freelist_hook+0xc2/0x190 [ 23.515589][ T372] kfree+0xc4/0x270 [ 23.519400][ T372] l2tp_session_put+0xaf/0x1a0 [ 23.524146][ T372] l2tp_session_delete+0x3a9/0x4a0 [ 23.529241][ T372] pppol2tp_release+0x169/0x2b0 [ 23.534071][ T372] sock_close+0xb8/0x200 [ 23.538298][ T372] __fput+0x22b/0x900 [ 23.542261][ T372] ____fput+0x15/0x20 [ 23.546231][ T372] task_work_run+0x127/0x190 [ 23.550800][ T372] do_exit+0xb70/0x29a0 [ 23.554935][ T372] do_group_exit+0x149/0x310 [ 23.559503][ T372] get_signal+0x64f/0x1430 [ 23.563896][ T372] arch_do_signal_or_restart+0xe2/0x1100 [ 23.569507][ T372] exit_to_user_mode_loop+0xa7/0xe0 [ 23.574682][ T372] exit_to_user_mode_prepare+0x87/0xd0 [ 23.580122][ T372] syscall_exit_to_user_mode+0x1a/0x30 [ 23.585561][ T372] do_syscall_64+0x58/0xa0 [ 23.589989][ T372] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 23.595862][ T372] [ 23.598166][ T372] The buggy address belongs to the object at ffff88812e406000 [ 23.598166][ T372] which belongs to the cache kmalloc-512 of size 512 [ 23.612193][ T372] The buggy address is located 336 bytes inside of [ 23.612193][ T372] 512-byte region [ffff88812e406000, ffff88812e406200) [ 23.625455][ T372] The buggy address belongs to the page: [ 23.631070][ T372] page:ffffea0004b90100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12e404 [ 23.641290][ T372] head:ffffea0004b90100 order:2 compound_mapcount:0 compound_pincount:0 [ 23.649598][ T372] flags: 0x4000000000010200(slab|head|zone=1) [ 23.655660][ T372] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 23.664220][ T372] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 23.672779][ T372] page dumped because: kasan: bad access detected [ 23.679170][ T372] page_owner tracks the page as allocated [ 23.684873][ T372] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 367, ts 23019390272, free_ts 0 [ 23.704386][ T372] post_alloc_hook+0x192/0x1b0 [ 23.709135][ T372] prep_new_page+0x1c/0x110 [ 23.713616][ T372] get_page_from_freelist+0x2c3a/0x2cd0 [ 23.719139][ T372] __alloc_pages+0x1a2/0x460 [ 23.723714][ T372] new_slab+0xa0/0x4d0 [ 23.727764][ T372] ___slab_alloc+0x3ac/0x840 [ 23.732338][ T372] __slab_alloc+0x49/0x90 [ 23.736667][ T372] kmem_cache_alloc_trace+0x146/0x270 [ 23.742019][ T372] find_css_set+0x91d/0x1560 [ 23.746609][ T372] cgroup_migrate_prepare_dst+0xc4/0xa00 [ 23.752220][ T372] cgroup_attach_task+0x298/0x520 [ 23.757227][ T372] __cgroup1_procs_write+0x314/0x520 [ 23.762493][ T372] cgroup1_procs_write+0x2a/0x40 [ 23.767408][ T372] cgroup_file_write+0x294/0x560 [ 23.772324][ T372] kernfs_fop_write_iter+0x2bd/0x400 [ 23.777593][ T372] vfs_write+0x831/0xfd0 [ 23.781817][ T372] page_owner free stack trace missing [ 23.787161][ T372] [ 23.789464][ T372] Memory state around the buggy address: [ 23.795076][ T372] ffff88812e406000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.803112][ T372] ffff88812e406080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.811149][ T372]