ess permissive=1 [ 13.162828][ T28] audit: type=1400 audit(1789787952.494:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.6' (ED25519) to the list of known hosts. 2026/09/19 03:19:21 parsed 1 programs 2026/09/19 03:19:21 serving rpc on tcp://46017 [ 22.351740][ T28] audit: type=1400 audit(1789787961.694:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 22.373378][ T28] audit: type=1400 audit(1789787961.694:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 23.140344][ T28] audit: type=1400 audit(1789787962.474:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.141512][ T301] cgroup: Unknown subsys name 'net' [ 23.163129][ T28] audit: type=1400 audit(1789787962.474:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.190434][ T28] audit: type=1400 audit(1789787962.504:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.190776][ T301] cgroup: Unknown subsys name 'devices' [ 23.312963][ T301] cgroup: Unknown subsys name 'hugetlb' [ 23.318632][ T301] cgroup: Unknown subsys name 'rlimit' [ 23.437314][ T28] audit: type=1400 audit(1789787962.774:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.460983][ T28] audit: type=1400 audit(1789787962.774:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.481402][ T28] audit: type=1400 audit(1789787962.774:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.501699][ T28] audit: type=1400 audit(1789787962.774:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.522001][ T28] audit: type=1400 audit(1789787962.774:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.553057][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.573694][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.290331][ T312] request_module fs-gadgetfs succeeded, but still no fs? [ 24.370689][ T321] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.377824][ T321] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.385664][ T321] device bridge_slave_0 entered promiscuous mode [ 24.392652][ T321] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.399672][ T321] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.407240][ T321] device bridge_slave_1 entered promiscuous mode [ 24.443697][ T321] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.450927][ T321] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.458255][ T321] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.465296][ T321] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.484534][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.491835][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.499203][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.506992][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.516223][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.524567][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.531705][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.541545][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.549801][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.556869][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.568688][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.578838][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.592297][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.603893][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.612113][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.620021][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.629134][ T321] device veth0_vlan entered promiscuous mode [ 24.639749][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.648940][ T321] device veth1_macvtap entered promiscuous mode [ 24.658463][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.668722][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.696992][ T321] syz-executor (321) used greatest stack depth: 21920 bytes left 2026/09/19 03:19:24 executed programs: 0 [ 25.312739][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.319796][ T367] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.327269][ T367] device bridge_slave_0 entered promiscuous mode [ 25.334367][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.341700][ T367] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.349093][ T367] device bridge_slave_1 entered promiscuous mode [ 25.405263][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.413115][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.426911][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.435478][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.444009][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.451136][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.458776][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.470254][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.478902][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.487327][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.494540][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.505461][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.513903][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.523346][ T43] device bridge_slave_1 left promiscuous mode [ 25.529552][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.537295][ T43] device bridge_slave_0 left promiscuous mode [ 25.543655][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.551949][ T43] device veth1_macvtap left promiscuous mode [ 25.557978][ T43] device veth0_vlan left promiscuous mode [ 25.606346][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.614478][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.628078][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.636494][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.647655][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.655813][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.666967][ T367] device veth0_vlan entered promiscuous mode [ 25.673369][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.681362][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.692683][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.701303][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.710552][ T367] device veth1_macvtap entered promiscuous mode [ 25.719542][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.727413][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.735867][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.745701][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.754692][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.782521][ T372] ================================================================== [ 25.790627][ T372] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x9c/0xb0 [ 25.798286][ T372] Write of size 8 at addr ffff888125b27d90 by task syz.2.17/372 [ 25.806002][ T372] [ 25.808342][ T372] CPU: 0 PID: 372 Comm: syz.2.17 Not tainted syzkaller #0 [ 25.815443][ T372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.825510][ T372] Call Trace: [ 25.828796][ T372] [ 25.831806][ T372] __dump_stack+0x21/0x24 [ 25.836134][ T372] dump_stack_lvl+0x110/0x170 [ 25.840821][ T372] ? __cfi_dump_stack_lvl+0x8/0x8 [ 25.845842][ T372] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 25.851123][ T372] print_address_description+0x71/0x200 [ 25.856684][ T372] print_report+0x4a/0x60 [ 25.861037][ T372] kasan_report+0x122/0x150 [ 25.865786][ T372] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 25.871072][ T372] __asan_report_store8_noabort+0x17/0x20 [ 25.876829][ T372] rcu_segcblist_enqueue+0x9c/0xb0 [ 25.881956][ T372] call_rcu+0x554/0xf50 [ 25.886107][ T372] ? __cfi_call_rcu+0x10/0x10 [ 25.890778][ T372] ? __kasan_check_write+0x14/0x20 [ 25.895892][ T372] ? selinux_inode_free_security+0x21f/0x230 [ 25.901903][ T372] security_inode_free+0xc5/0xe0 [ 25.906841][ T372] __destroy_inode+0x175/0x500 [ 25.911629][ T372] evict+0x777/0x8c0 [ 25.915950][ T372] ? proc_nr_inodes+0x2f0/0x2f0 [ 25.921659][ T372] ? _raw_spin_lock+0x94/0xf0 [ 25.928515][ T372] ? __cfi__raw_spin_lock+0x10/0x10 [ 25.933977][ T372] ? __kasan_check_write+0x14/0x20 [ 25.940262][ T372] iput+0x633/0x690 [ 25.946959][ T372] dentry_unlink_inode+0x346/0x3f0 [ 25.953558][ T372] __dentry_kill+0x46c/0x680 [ 25.958198][ T372] dentry_kill+0xc0/0x2a0 [ 25.962548][ T372] dput+0x42/0x80 [ 25.966216][ T372] __fput+0x5c0/0x8f0 [ 25.970228][ T372] ____fput+0x15/0x20 [ 25.974211][ T372] task_work_run+0x1e1/0x250 [ 25.978997][ T372] ? __cfi_task_work_run+0x10/0x10 [ 25.984476][ T372] ? __cfi___close_range+0x10/0x10 [ 25.989597][ T372] exit_to_user_mode_loop+0x9b/0xb0 [ 25.994833][ T372] exit_to_user_mode_prepare+0x87/0xd0 [ 26.000572][ T372] syscall_exit_to_user_mode+0x1a/0x30 [ 26.006050][ T372] do_syscall_64+0x58/0xa0 [ 26.010514][ T372] ? clear_bhb_loop+0x30/0x80 [ 26.015184][ T372] ? clear_bhb_loop+0x30/0x80 [ 26.019879][ T372] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.025767][ T372] RIP: 0033:0x7f667059e159 [ 26.030188][ T372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.049802][ T372] RSP: 002b:00007ffc9884c7b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 26.058284][ T372] RAX: 0000000000000000 RBX: 00007ffc9884c8a0 RCX: 00007f667059e159 [ 26.066299][ T372] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 26.074254][ T372] RBP: 000000000000649e R08: 0000000000000001 R09: 0000000000000000 [ 26.082304][ T372] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007ffc9884c8e0 [ 26.090270][ T372] R13: 00007f6670825fac R14: 00000000000064d3 R15: 00007f6670825fa0 [ 26.098238][ T372] [ 26.101253][ T372] [ 26.103573][ T372] Allocated by task 373: [ 26.107798][ T372] kasan_set_track+0x4b/0x70 [ 26.112382][ T372] kasan_save_alloc_info+0x1f/0x30 [ 26.117513][ T372] __kasan_kmalloc+0x95/0xb0 [ 26.122125][ T372] __kmalloc+0xb4/0x1e0 [ 26.126278][ T372] l2tp_session_create+0x38/0xbd0 [ 26.131406][ T372] pppol2tp_connect+0xbf5/0x1640 [ 26.136347][ T372] __sys_connect+0x3da/0x460 [ 26.140930][ T372] __x64_sys_connect+0x7a/0x90 [ 26.145772][ T372] x64_sys_call+0x88d/0x9a0 [ 26.150264][ T372] do_syscall_64+0x4c/0xa0 [ 26.154673][ T372] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.160552][ T372] [ 26.162857][ T372] Freed by task 10: [ 26.166642][ T372] kasan_set_track+0x4b/0x70 [ 26.171221][ T372] kasan_save_free_info+0x2b/0x40 [ 26.176231][ T372] ____kasan_slab_free+0x132/0x180 [ 26.181325][ T372] __kasan_slab_free+0x11/0x20 [ 26.186074][ T372] slab_free_freelist_hook+0xc2/0x190 [ 26.191423][ T372] __kmem_cache_free+0xb7/0x1b0 [ 26.196359][ T372] kfree+0x6f/0xf0 [ 26.200594][ T372] l2tp_session_put+0xaf/0x1a0 [ 26.205693][ T372] l2tp_session_delete+0x3df/0x4d0 [ 26.210927][ T372] l2tp_tunnel_del_work+0x199/0x410 [ 26.216219][ T372] process_one_work+0x717/0xc30 [ 26.221090][ T372] worker_thread+0xa4d/0x11d0 [ 26.225819][ T372] kthread+0x281/0x320 [ 26.229989][ T372] ret_from_fork+0x1f/0x30 [ 26.234420][ T372] [ 26.236764][ T372] Last potentially related work creation: [ 26.242599][ T372] kasan_save_stack+0x3a/0x60 [ 26.247271][ T372] __kasan_record_aux_stack+0xb6/0xc0 [ 26.252624][ T372] kasan_record_aux_stack_noalloc+0xb/0x10 [ 26.258415][ T372] call_rcu+0xcf/0xf50 [ 26.262484][ T372] pppol2tp_release+0x1e3/0x2b0 [ 26.267334][ T372] sock_close+0xc9/0x220 [ 26.271559][ T372] __fput+0x1fd/0x8f0 [ 26.275554][ T372] ____fput+0x15/0x20 [ 26.279546][ T372] task_work_run+0x1e1/0x250 [ 26.284231][ T372] exit_to_user_mode_loop+0x9b/0xb0 [ 26.289440][ T372] exit_to_user_mode_prepare+0x87/0xd0 [ 26.294899][ T372] syscall_exit_to_user_mode+0x1a/0x30 [ 26.300356][ T372] do_syscall_64+0x58/0xa0 [ 26.304771][ T372] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.310651][ T372] [ 26.313080][ T372] The buggy address belongs to the object at ffff888125b27c00 [ 26.313080][ T372] which belongs to the cache kmalloc-512 of size 512 [ 26.328273][ T372] The buggy address is located 400 bytes inside of [ 26.328273][ T372] 512-byte region [ffff888125b27c00, ffff888125b27e00) [ 26.342046][ T372] [ 26.344374][ T372] The buggy address belongs to the physical page: [ 26.350772][ T372] page:ffffea000496c900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x125b24 [ 26.361011][ T372] head:ffffea000496c900 order:2 compound_mapcount:0 compound_pincount:0 [ 26.369322][ T372] flags: 0x4000000000010200(slab|head|zone=1) [ 26.375511][ T372] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 26.384080][ T372] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 26.392641][ T372] page dumped because: kasan: bad access detected [ 26.399063][ T372] page_owner tracks the page as allocated [ 26.405067][ T372] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 367, tgid 367 (syz-executor), ts 25775335923, free_ts 25110552992 [ 26.427818][ T372] post_alloc_hook+0x1f5/0x210 [ 26.432755][ T372] prep_new_page+0x1c/0x110 [ 26.437450][ T372] get_page_from_freelist+0x2ca9/0x2d20 [ 26.443009][ T372] __alloc_pages+0x1fa/0x610 [ 26.447587][ T372] alloc_slab_page+0x6e/0xf0 [ 26.452163][ T372] new_slab+0x98/0x3e0 [ 26.456224][ T372] ___slab_alloc+0x70f/0xb70 [ 26.460805][ T372] __slab_alloc+0x5e/0xa0 [ 26.465125][ T372] __kmem_cache_alloc_node+0x204/0x2d0 [ 26.470586][ T372] kmalloc_trace+0x29/0xb0 [ 26.474992][ T372] find_css_set+0x937/0x15c0 [ 26.479567][ T372] cgroup_migrate_prepare_dst+0xc4/0xa00 [ 26.485182][ T372] cgroup_attach_task+0x298/0x520 [ 26.490194][ T372] __cgroup1_procs_write+0x314/0x520 [ 26.495464][ T372] cgroup1_procs_write+0x2a/0x40 [ 26.500389][ T372] cgroup_file_write+0x2a2/0x590 [ 26.505321][ T372] page last free stack trace: [ 26.509979][ T372] free_unref_page_prepare+0x81b/0x820 [ 26.515426][ T372] free_unref_page+0x93/0x530 [ 26.520088][ T372] __free_pages+0x67/0x100 [ 26.524495][ T372] __vunmap+0xa3c/0xc00 [ 26.528737][ T372] vfree+0x61/0x90 [ 26.532438][ T372] kcov_close+0x2b/0x50 [ 26.536591][ T372] __fput+0x1fd/0x8f0 [ 26.540580][ T372] ____fput+0x15/0x20 [ 26.544551][ T372] task_work_run+0x1e1/0x250 [ 26.549130][ T372] do_exit+0xb0d/0x29f0 [ 26.553280][ T372] do_group_exit+0x21b/0x2e0 [ 26.557860][ T372] get_signal+0x167c/0x1700 [ 26.562350][ T372] arch_do_signal_or_restart+0xd1/0x11c0 [ 26.568075][ T372] exit_to_user_mode_loop+0x7a/0xb0 [ 26.573258][ T372] exit_to_user_mode_prepare+0x87/0xd0 [ 26.578702][ T372] syscall_exit_to_user_mode+0x1a/0x30 [ 26.584166][ T372] [ 26.586472][ T372] Memory state around the buggy address: [ 26.592097][ T372] ffff888125b27c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.600139][ T372] ffff888125b27d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.608180][ T372] >ffff888125b27d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.616306][ T372] ^ [ 26.620873][ T372] ffff888125b27e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.629301][ T372] ffff888125b27e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.637353][ T372] ================================================================== [ 26.645396][ T372] Disabling lock debugging due to kernel taint