rocess permissive=1 [ 10.757688][ T24] audit: type=1400 audit(1794185841.240:63): avc: denied { siginh } for pid=214 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.238' (ED25519) to the list of known hosts. 2026/11/09 00:57:30 parsed 1 programs 2026/11/09 00:57:30 serving rpc on tcp://38239 [ 19.775794][ T24] audit: type=1400 audit(1794185850.290:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 19.783577][ T24] audit: type=1400 audit(1794185850.290:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 19.791198][ T24] audit: type=1400 audit(1794185850.290:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 20.424046][ T24] audit: type=1400 audit(1794185850.940:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.425007][ T293] cgroup: Unknown subsys name 'net' [ 20.446810][ T24] audit: type=1400 audit(1794185850.940:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.474169][ T24] audit: type=1400 audit(1794185850.970:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.475135][ T293] cgroup: Unknown subsys name 'devices' [ 20.620649][ T293] cgroup: Unknown subsys name 'hugetlb' [ 20.626709][ T293] cgroup: Unknown subsys name 'rlimit' [ 20.738947][ T24] audit: type=1400 audit(1794185851.260:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.762523][ T24] audit: type=1400 audit(1794185851.260:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 20.770981][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 20.783486][ T24] audit: type=1400 audit(1794185851.260:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 20.812288][ T24] audit: type=1400 audit(1794185851.260:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 20.838228][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.288700][ T302] request_module fs-gadgetfs succeeded, but still no fs? [ 21.301348][ T302] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.567038][ T323] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.574112][ T323] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.581893][ T323] device bridge_slave_0 entered promiscuous mode [ 21.589447][ T323] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.596589][ T323] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.603947][ T323] device bridge_slave_1 entered promiscuous mode [ 21.638203][ T323] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.645364][ T323] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.652785][ T323] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.659824][ T323] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.675893][ T324] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.683137][ T324] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.690569][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.698035][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.708158][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.716366][ T324] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.723401][ T324] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.731891][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.740054][ T324] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.747191][ T324] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.762422][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.771891][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.784270][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.794841][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.802910][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.810679][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.819039][ T323] device veth0_vlan entered promiscuous mode [ 21.828620][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.837582][ T323] device veth1_macvtap entered promiscuous mode [ 21.846309][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.856511][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/11/09 00:57:32 executed programs: 0 [ 22.360348][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.367496][ T364] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.375037][ T364] device bridge_slave_0 entered promiscuous mode [ 22.382129][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.389246][ T364] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.396673][ T364] device bridge_slave_1 entered promiscuous mode [ 22.433418][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.440472][ T364] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.447703][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.454758][ T364] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.470336][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.477872][ T324] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.485697][ T324] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.494827][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.503437][ T324] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.510480][ T324] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.528094][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.536756][ T324] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.543832][ T324] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.551418][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.559904][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.570469][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.578822][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.591819][ T364] device veth0_vlan entered promiscuous mode [ 22.598650][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.606838][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.615198][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.622890][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.634408][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.642581][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.651783][ T364] device veth1_macvtap entered promiscuous mode [ 22.661007][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.668617][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.677089][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.689055][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.697533][ T324] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.719117][ T385] ================================================================== [ 22.727213][ T385] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x4b/0xa0 [ 22.734831][ T385] Write of size 8 at addr ffff8881271cf190 by task syz.2.17/385 [ 22.742463][ T385] [ 22.745050][ T385] CPU: 0 PID: 385 Comm: syz.2.17 Not tainted syzkaller #0 [ 22.752146][ T385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 22.762363][ T385] Call Trace: [ 22.765736][ T385] __dump_stack+0x21/0x24 [ 22.770055][ T385] dump_stack_lvl+0x1a7/0x208 [ 22.774721][ T385] ? show_regs_print_info+0x18/0x18 [ 22.779998][ T385] ? thaw_kernel_threads+0x220/0x220 [ 22.785283][ T385] print_address_description+0x7f/0x2c0 [ 22.790819][ T385] ? rcu_segcblist_enqueue+0x4b/0xa0 [ 22.796184][ T385] kasan_report+0x100/0x140 [ 22.800680][ T385] ? rcu_segcblist_enqueue+0x4b/0xa0 [ 22.805957][ T385] __asan_report_store8_noabort+0x17/0x20 [ 22.811677][ T385] rcu_segcblist_enqueue+0x4b/0xa0 [ 22.816873][ T385] call_rcu+0x4df/0x1090 [ 22.821111][ T385] ? local_bh_enable+0x1f/0x30 [ 22.825867][ T385] ? lock_sock_nested+0x217/0x2a0 [ 22.831142][ T385] ? rcu_gp_kthread_wake+0x90/0x90 [ 22.836245][ T385] ? __kasan_check_write+0x14/0x20 [ 22.841348][ T385] ? mutex_lock+0x92/0xf0 [ 22.845686][ T385] ? mutex_trylock+0xb0/0xb0 [ 22.850305][ T385] pppol2tp_release+0x1e3/0x2b0 [ 22.855190][ T385] sock_close+0xb8/0x200 [ 22.859439][ T385] ? sock_mmap+0xa0/0xa0 [ 22.863690][ T385] __fput+0x2dc/0x730 [ 22.867665][ T385] ____fput+0x15/0x20 [ 22.871640][ T385] task_work_run+0x127/0x190 [ 22.876226][ T385] exit_to_user_mode_loop+0xcb/0xe0 [ 22.881425][ T385] exit_to_user_mode_prepare+0x76/0xa0 [ 22.886878][ T385] syscall_exit_to_user_mode+0x1d/0x40 [ 22.892333][ T385] do_syscall_64+0x3d/0x40 [ 22.896743][ T385] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.902747][ T385] RIP: 0033:0x7f2937b65b19 [ 22.907157][ T385] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 22.927011][ T385] RSP: 002b:00007ffe8ac53568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 22.935591][ T385] RAX: 0000000000000000 RBX: 00007ffe8ac53650 RCX: 00007f2937b65b19 [ 22.943648][ T385] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 22.951612][ T385] RBP: 00000000000058ab R08: 0000000000000001 R09: 0000000000000000 [ 22.959575][ T385] R10: 0000001b32b20000 R11: 0000000000000246 R12: 00007ffe8ac53690 [ 22.967538][ T385] R13: 00007f2937debfac R14: 00000000000058de R15: 00007f2937debfa0 [ 22.975501][ T385] [ 22.977908][ T385] Allocated by task 386: [ 22.982144][ T385] __kasan_kmalloc+0xd4/0x100 [ 22.986809][ T385] __kmalloc+0x19f/0x330 [ 22.991087][ T385] l2tp_session_create+0x39/0xb60 [ 22.996099][ T385] pppol2tp_connect+0xbf5/0x1640 [ 23.001026][ T385] __sys_connect+0x3ce/0x450 [ 23.005605][ T385] __x64_sys_connect+0x7a/0x90 [ 23.010358][ T385] do_syscall_64+0x31/0x40 [ 23.014782][ T385] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.020746][ T385] [ 23.023069][ T385] Freed by task 324: [ 23.027057][ T385] kasan_set_track+0x4a/0x70 [ 23.031724][ T385] kasan_set_free_info+0x23/0x40 [ 23.036657][ T385] ____kasan_slab_free+0x125/0x160 [ 23.041860][ T385] __kasan_slab_free+0x11/0x20 [ 23.046699][ T385] slab_free_freelist_hook+0xc5/0x190 [ 23.052079][ T385] kfree+0xc0/0x270 [ 23.055876][ T385] l2tp_session_put+0xb2/0x1a0 [ 23.060660][ T385] l2tp_session_delete+0x3a9/0x4a0 [ 23.065762][ T385] l2tp_tunnel_del_work+0x180/0x3d0 [ 23.070953][ T385] process_one_work+0x6fd/0xbc0 [ 23.075793][ T385] worker_thread+0xa8e/0x13c0 [ 23.080460][ T385] kthread+0x324/0x3b0 [ 23.084523][ T385] ret_from_fork+0x1f/0x30 [ 23.088954][ T385] [ 23.091458][ T385] Last potentially related work creation: [ 23.097178][ T385] kasan_save_stack+0x3a/0x60 [ 23.101868][ T385] __kasan_record_aux_stack+0xd2/0x100 [ 23.107337][ T385] kasan_record_aux_stack_noalloc+0xb/0x10 [ 23.113152][ T385] call_rcu+0x11a/0x1090 [ 23.117398][ T385] pppol2tp_release+0x1e3/0x2b0 [ 23.122240][ T385] sock_close+0xb8/0x200 [ 23.126473][ T385] __fput+0x2dc/0x730 [ 23.130554][ T385] ____fput+0x15/0x20 [ 23.134537][ T385] task_work_run+0x127/0x190 [ 23.139130][ T385] exit_to_user_mode_loop+0xcb/0xe0 [ 23.144417][ T385] exit_to_user_mode_prepare+0x76/0xa0 [ 23.150144][ T385] syscall_exit_to_user_mode+0x1d/0x40 [ 23.155593][ T385] do_syscall_64+0x3d/0x40 [ 23.160008][ T385] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.165977][ T385] [ 23.168387][ T385] The buggy address belongs to the object at ffff8881271cf000 [ 23.168387][ T385] which belongs to the cache kmalloc-512 of size 512 [ 23.182434][ T385] The buggy address is located 400 bytes inside of [ 23.182434][ T385] 512-byte region [ffff8881271cf000, ffff8881271cf200) [ 23.195819][ T385] The buggy address belongs to the page: [ 23.201453][ T385] page:ffffea00049c7300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1271cc [ 23.211702][ T385] head:ffffea00049c7300 order:2 compound_mapcount:0 compound_pincount:0 [ 23.220016][ T385] flags: 0x4000000000010200(slab|head) [ 23.225473][ T385] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 23.234050][ T385] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 23.242619][ T385] page dumped because: kasan: bad access detected [ 23.249022][ T385] page_owner tracks the page as allocated [ 23.254918][ T385] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 364, ts 22711330489, free_ts 22688183162 [ 23.275395][ T385] prep_new_page+0x176/0x190 [ 23.279980][ T385] get_page_from_freelist+0x225f/0x23f0 [ 23.285808][ T385] __alloc_pages_nodemask+0x29a/0x640 [ 23.291168][ T385] new_slab+0x84/0x3f0 [ 23.295227][ T385] ___slab_alloc+0x2f8/0x4c0 [ 23.299829][ T385] __slab_alloc+0x63/0xa0 [ 23.304420][ T385] __kmalloc_track_caller+0x1e4/0x310 [ 23.309789][ T385] __alloc_skb+0xdc/0x520 [ 23.314109][ T385] netlink_ack+0x35c/0xb30 [ 23.318513][ T385] netlink_rcv_skb+0x267/0x430 [ 23.323270][ T385] rtnetlink_rcv+0x1c/0x20 [ 23.327683][ T385] netlink_unicast+0x86c/0xa30 [ 23.332436][ T385] netlink_sendmsg+0x949/0xb70 [ 23.337204][ T385] __sys_sendto+0x467/0x620 [ 23.341785][ T385] __x64_sys_sendto+0xe5/0x100 [ 23.346539][ T385] do_syscall_64+0x31/0x40 [ 23.350955][ T385] page last free stack trace: [ 23.355625][ T385] __free_pages_ok+0x80b/0x830 [ 23.360380][ T385] __free_pages+0xd8/0x390 [ 23.364787][ T385] kfree+0x1e4/0x270 [ 23.368673][ T385] tipc_nametbl_stop+0x120b/0x1270 [ 23.373871][ T385] tipc_exit_net+0x99/0x150 [ 23.378368][ T385] cleanup_net+0x589/0xb80 [ 23.382781][ T385] process_one_work+0x6fd/0xbc0 [ 23.387622][ T385] worker_thread+0xa8e/0x13c0 [ 23.392288][ T385] kthread+0x324/0x3b0 [ 23.396379][ T385] ret_from_fork+0x1f/0x30 [ 23.400778][ T385] [ 23.403095][ T385] Memory state around the buggy address: [ 23.408721][ T385] ffff8881271cf080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.416775][ T385] ffff8881271cf100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.424925][ T385] >ffff8881271cf180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.432989][ T385] ^ [ 23.437662][ T385] ffff8881271cf200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.445801][ T385] ffff8881271cf280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.453943][ T385] ================================================================== [ 23.462084][ T385] Disabling lock debugging due to kernel taint [ 23.675466][ T411] ------------[ cut here ]------------ [ 23.681129][ T411] refcount_t: underflow; use-after-free. [ 23.686921][ T411] WARNING: CPU: 1 PID: 411 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 23.696551][ T411] Modules linked in: [ 23.700719][ T411] CPU: 1 PID: 411 Comm: syz.2.30 Tainted: G B syzkaller #0 [ 23.709252][ T411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 23.720476][ T411] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 23.726824][ T411] Code: 04 01 48 c7 c7 c0 52 40 85 e8 5c 04 3c 02 0f 0b eb c3 e8 d3 80 26 ff c6 05 b2 70 82 04 01 48 c7 c7 20 53 40 85 e8 40 04 3c 02 <0f> 0b eb a7 e8 b7 80 26 ff c6 05 93 70 82 04 01 48 c7 c7 40 52 40 [ 23.746954][ T411] RSP: 0018:ffffc90000e57d18 EFLAGS: 00010246 [ 23.753195][ T411] RAX: 9fd733f3ba148300 RBX: 0000000000000003 RCX: ffff88810f909400 [ 23.761258][ T411] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 23.770062][ T411] RBP: ffffc90000e57d28 R08: ffff8881f7127493 R09: 1ffff1103ee24e92 [ 23.778050][ T411] R10: dffffc0000000000 R11: ffffed103ee24e93 R12: 0000000000000000 [ 23.786289][ T411] R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000000 [ 23.794396][ T411] FS: 000055556f895500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 23.804001][ T411] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.810839][ T411] CR2: 0000200000000000 CR3: 000000010fd56000 CR4: 00000000003506a0 [ 23.818866][ T411] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 23.826873][ T411] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 23.834904][ T411] Call Trace: [ 23.838212][ T411] l2tp_session_put+0xcb/0x1a0 [ 23.843747][ T411] l2tp_session_delete+0x3a9/0x4a0 [ 23.848924][ T411] pppol2tp_release+0x169/0x2b0 [ 23.853801][ T411] sock_close+0xb8/0x200 [ 23.858065][ T411] ? sock_mmap+0xa0/0xa0 [ 23.862356][ T411] __fput+0x2dc/0x730 [ 23.866359][ T411] ____fput+0x15/0x20 [ 23.870399][ T411] task_work_run+0x127/0x190 [ 23.875176][ T411] exit_to_user_mode_loop+0xcb/0xe0 [ 23.880563][ T411] exit_to_user_mode_prepare+0x76/0xa0 [ 23.886025][ T411] syscall_exit_to_user_mode+0x1d/0x40 [ 23.891507][ T411] do_syscall_64+0x3d/0x40 [ 23.896394][ T411] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.902317][ T411] RIP: 0033:0x7f2937b65b19 [ 23.906921][ T411] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 23.926573][ T411] RSP: 002b:00007ffe8ac53568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 23.935143][ T411] RAX: 0000000000000000 RBX: 00007ffe8ac53650 RCX: 00007f2937b65b19 [ 23.943191][ T411] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 23.951202][ T411] RBP: 0000000000005c68 R08: 0000000000000001 R09: 0000000000000000 [ 23.959222][ T411] R10: 0000001b32b20000 R11: 0000000000000246 R12: 00007ffe8ac53690 [ 23.967223][ T411] R13: 00007f2937debfac R14: 0000000000005c9a R15: 00007f2937debfa0 [ 23.975381][ T411] ---[ end trace 5d11b5392fd08ef1 ]--- [ 24.282781][ T447] ------------[ cut here ]------------ [ 24.288309][ T447] WARNING: CPU: 1 PID: 447 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 24.298354][ T447] Modules linked in: [ 24.302447][ T447] CPU: 1 PID: 447 Comm: syz.2.48 Tainted: G B W syzkaller #0 [ 24.311129][ T447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 24.321257][ T447] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 24.327580][ T447] Code: 5d c3 e8 ec bd 34 fd be 02 00 00 00 eb 0a e8 e0 bd 34 fd be 01 00 00 00 4c 89 f7 e8 f3 3b 0e fe e9 0f ff ff ff e8 c9 bd 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 b8 bd 34 fd 4c 89 f7 be 03 [ 24.347477][ T447] RSP: 0018:ffffc90000e77d68 EFLAGS: 00010293 [ 24.353687][ T447] RAX: ffffffff842ff8f7 RBX: ffff888110a79800 RCX: ffff888110b6a800 [ 24.361925][ T447] RDX: 0000000000000000 RSI: 000000000cc9c7e0 RDI: 000000000c04eb7d [ 24.370763][ T447] RBP: ffffc90000e77d88 R08: ffff888110a79883 R09: 1ffff1102214f310 [ 24.378845][ T447] R10: dffffc0000000000 R11: ffffed102214f311 R12: dffffc0000000000 [ 24.386976][ T447] R13: dffffc0000000000 R14: 000000000cc9c7e0 R15: ffff88811038ec00 [ 24.395280][ T447] FS: 000055556f895500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 24.404352][ T447] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.411006][ T447] CR2: 0000200000000000 CR3: 00000001102a5000 CR4: 00000000003506a0 [ 24.419053][ T447] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.427051][ T447] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.435054][ T447] Call Trace: [ 24.438358][ T447] pppol2tp_release+0x150/0x2b0 [ 24.443232][ T447] sock_close+0xb8/0x200 [ 24.447504][ T447] ? sock_mmap+0xa0/0xa0 [ 24.451974][ T447] __fput+0x2dc/0x730 [ 24.456052][ T447] ____fput+0x15/0x20 [ 24.460058][ T447] task_work_run+0x127/0x190 [ 24.464672][ T447] exit_to_user_mode_loop+0xcb/0xe0 [ 24.469907][ T447] exit_to_user_mode_prepare+0x76/0xa0 [ 24.475570][ T447] syscall_exit_to_user_mode+0x1d/0x40 [ 24.481054][ T447] do_syscall_64+0x3d/0x40 [ 24.485513][ T447] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.491439][ T447] RIP: 0033:0x7f2937b65b19 [ 24.495896][ T447] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.515804][ T447] RSP: 002b:00007ffe8ac53568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 24.526118][ T447] RAX: 0000000000000000 RBX: 00007ffe8ac53650 RCX: 00007f2937b65b19 [ 24.537141][ T447] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 24.545175][ T447] RBP: 0000000000005ec7 R08: 0000000000000001 R09: 0000000000000000 [ 24.553171][ T447] R10: 0000001b32b20000 R11: 0000000000000246 R12: 00007ffe8ac53690 [ 24.561249][ T447] R13: 00007f2937debfac R14: 0000000000005ef9 R15: 00007f2937debfa0 [ 24.569256][ T447] ---[ end trace 5d11b5392fd08ef2 ]--- [ 24.580840][ T112] device bridge_slave_1 left promiscuous mode [ 24.587249][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.594928][ T112] device bridge_slave_0 left promiscuous mode [ 24.601362][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.609305][ T112] device veth1_macvtap left promiscuous mode [ 24.615297][ T112] device veth0_vlan left promiscuous mode [ 24.622376][ T453] ------------[ cut here ]------------ [ 24.627876][ T453] WARNING: CPU: 0 PID: 453 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 24.638063][ T453] Modules linked in: [ 24.642269][ T453] CPU: 0 PID: 453 Comm: syz.2.51 Tainted: G B W syzkaller #0 [ 24.651006][ T453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 24.661146][ T453] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 24.667806][ T453] Code: 5d c3 e8 ec bd 34 fd be 02 00 00 00 eb 0a e8 e0 bd 34 fd be 01 00 00 00 4c 89 f7 e8 f3 3b 0e fe e9 0f ff ff ff e8 c9 bd 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 b8 bd 34 fd 4c 89 f7 be 03 [ 24.687742][ T453] RSP: 0018:ffffc90000e87d68 EFLAGS: 00010293 [ 24.694011][ T453] RAX: ffffffff842ff8f7 RBX: ffff88810fd20000 RCX: ffff888110edbc00 [ 24.702421][ T453] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000c04eb7d [ 24.710450][ T453] RBP: ffffc90000e87d88 R08: ffff88810fd20083 R09: 1ffff11021fa4010 [ 24.718431][ T453] R10: dffffc0000000000 R11: ffffed1021fa4011 R12: dffffc0000000000 [ 24.726557][ T453] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888110d5dc00 [ 24.734590][ T453] FS: 000055556f895500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 24.743709][ T453] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.750990][ T453] CR2: 0000200000000000 CR3: 000000010fcf9000 CR4: 00000000003506b0 [ 24.759441][ T453] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.767623][ T453] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.775800][ T453] Call Trace: [ 24.779248][ T453] pppol2tp_release+0x150/0x2b0 [ 24.784128][ T453] sock_close+0xb8/0x200 [ 24.788364][ T453] ? sock_mmap+0xa0/0xa0 [ 24.792663][ T453] __fput+0x2dc/0x730 [ 24.796684][ T453] ____fput+0x15/0x20 [ 24.800757][ T453] task_work_run+0x127/0x190 [ 24.805396][ T453] exit_to_user_mode_loop+0xcb/0xe0 [ 24.810703][ T453] exit_to_user_mode_prepare+0x76/0xa0 [ 24.816186][ T453] syscall_exit_to_user_mode+0x1d/0x40 [ 24.821790][ T453] do_syscall_64+0x3d/0x40 [ 24.826224][ T453] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.832174][ T453] RIP: 0033:0x7f2937b65b19 [ 24.836651][ T453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.856592][ T453] RSP: 002b:00007ffe8ac53568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 24.865208][ T453] RAX: 0000000000000000 RBX: 00007ffe8ac53650 RCX: 00007f2937b65b19 [ 24.873735][ T453] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 24.881967][ T453] RBP: 000000000000601a R08: 0000000000000001 R09: 0000000000000000 [ 24.890048][ T453] R10: 0000001b32b20000 R11: 0000000000000246 R12: 00007ffe8ac53690 [ 24.898148][ T453] R13: 00007f2937debfac R14: 000000000000604d R15: 00007f2937debfa0 [ 24.906198][ T453] ---[ end trace 5d11b5392fd08ef3 ]--- 2026/11/09 00:57:37 executed programs: 181 [ 31.931656][ T1313] ------------[ cut here ]------------ [ 31.937229][ T1313] WARNING: CPU: 0 PID: 1313 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 31.947444][ T1313] Modules linked in: [ 31.951548][ T1313] CPU: 0 PID: 1313 Comm: syz.2.471 Tainted: G B W syzkaller #0 [ 31.960365][ T1313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 31.970528][ T1313] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 31.976844][ T1313] Code: 5d c3 e8 ec bd 34 fd be 02 00 00 00 eb 0a e8 e0 bd 34 fd be 01 00 00 00 4c 89 f7 e8 f3 3b 0e fe e9 0f ff ff ff e8 c9 bd 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 b8 bd 34 fd 4c 89 f7 be 03 [ 31.996987][ T1313] RSP: 0018:ffffc90002fcfd68 EFLAGS: 00010293 [ 32.003228][ T1313] RAX: ffffffff842ff8f7 RBX: ffff888112bd6000 RCX: ffff888117eb5000 [ 32.011227][ T1313] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000c04eb7d [ 32.019239][ T1313] RBP: ffffc90002fcfd88 R08: ffff888112bd6083 R09: 1ffff1102257ac10 [ 32.027203][ T1313] R10: dffffc0000000000 R11: ffffed102257ac11 R12: dffffc0000000000 [ 32.035731][ T1313] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881128e5000 [ 32.043727][ T1313] FS: 000055556f895500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 32.052821][ T1313] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.059469][ T1313] CR2: 0000200000000000 CR3: 000000011743f000 CR4: 00000000003506b0 [ 32.067491][ T1313] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.075497][ T1313] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.083486][ T1313] Call Trace: [ 32.086764][ T1313] pppol2tp_release+0x150/0x2b0 [ 32.091630][ T1313] sock_close+0xb8/0x200 [ 32.095943][ T1313] ? sock_mmap+0xa0/0xa0 [ 32.100647][ T1313] __fput+0x2dc/0x730 [ 32.104941][ T1313] ____fput+0x15/0x20 [ 32.109397][ T1313] task_work_run+0x127/0x190 [ 32.114107][ T1313] exit_to_user_mode_loop+0xcb/0xe0 [ 32.119564][ T1313] exit_to_user_mode_prepare+0x76/0xa0 [ 32.125048][ T1313] syscall_exit_to_user_mode+0x1d/0x40 [ 32.130658][ T1313] do_syscall_64+0x3d/0x40 [ 32.135104][ T1313] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.141038][ T1313] RIP: 0033:0x7f2937b65b19 [ 32.145462][ T1313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.165398][ T1313] RSP: 002b:00007ffe8ac53568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 32.173840][ T1313] RAX: 0000000000000000 RBX: 00007ffe8ac53650 RCX: 00007f2937b65b19 [ 32.181843][ T1313] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 32.189832][ T1313] RBP: 0000000000007ca8 R08: 0000000000000001 R09: 0000000000000000 [ 32.197811][ T1313] R10: 0000001b32b20000 R11: 0000000000000246 R12: 00007ffe8ac53690 [ 32.205814][ T1313] R13: 00007f2937debfac R14: 0000000000007cda R15: 00007f2937debfa0 [ 32.213799][ T1313] ---[ end trace 5d11b5392fd08ef4 ]--- [ 32.223177][ T1315] ------------[ cut here ]------------ [ 32.228696][ T1315] WARNING: CPU: 1 PID: 1315 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.238828][ T1315] Modules linked in: [ 32.242828][ T1315] CPU: 1 PID: 1315 Comm: syz.2.472 Tainted: G B W syzkaller #0 [ 32.251635][ T1315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 32.261865][ T1315] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.268364][ T1315] Code: 5d c3 e8 ec bd 34 fd be 02 00 00 00 eb 0a e8 e0 bd 34 fd be 01 00 00 00 4c 89 f7 e8 f3 3b 0e fe e9 0f ff ff ff e8 c9 bd 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 b8 bd 34 fd 4c 89 f7 be 03 [ 32.288200][ T1315] RSP: 0018:ffffc90002897d68 EFLAGS: 00010293 [ 32.294396][ T1315] RAX: ffffffff842ff8f7 RBX: ffff888117fbb800 RCX: ffff888117ec9400 [ 32.302386][ T1315] RDX: 0000000000000000 RSI: 00000000174b94a0 RDI: 000000000c04eb7d [ 32.310497][ T1315] RBP: ffffc90002897d88 R08: ffff888117fbb883 R09: 1ffff11022ff7710 [ 32.318554][ T1315] R10: dffffc0000000000 R11: ffffed1022ff7711 R12: dffffc0000000000 [ 32.326730][ T1315] R13: dffffc0000000000 R14: 00000000174b94a0 R15: ffff888117fc7c00 [ 32.334731][ T1315] FS: 000055556f895500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 32.343783][ T1315] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.350427][ T1315] CR2: 0000200000000000 CR3: 00000001172a6000 CR4: 00000000003506a0 [ 32.358417][ T1315] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.366518][ T1315] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.374512][ T1315] Call Trace: [ 32.377790][ T1315] pppol2tp_release+0x150/0x2b0 [ 32.382661][ T1315] sock_close+0xb8/0x200 [ 32.386909][ T1315] ? sock_mmap+0xa0/0xa0 [ 32.391396][ T1315] __fput+0x2dc/0x730 [ 32.395364][ T1315] ____fput+0x15/0x20 [ 32.399377][ T1315] task_work_run+0x127/0x190 [ 32.404144][ T1315] exit_to_user_mode_loop+0xcb/0xe0 [ 32.409525][ T1315] exit_to_user_mode_prepare+0x76/0xa0 [ 32.414990][ T1315] syscall_exit_to_user_mode+0x1d/0x40 [ 32.420458][ T1315] do_syscall_64+0x3d/0x40 [ 32.424886][ T1315] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.430897][ T1315] RIP: 0033:0x7f2937b65b19 [ 32.435342][ T1315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.454958][ T1315] RSP: 002b:00007ffe8ac53568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 32.463661][ T1315] RAX: 0000000000000000 RBX: 00007ffe8ac53650 RCX: 00007f2937b65b19 [ 32.471680][ T1315] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 2026/11/09 00:57:43 executed programs: 458 [ 32.479689][ T1315] RBP: 0000000000007dcb R08: 0000000000000001 R09: 0000000000000000 [ 32.487715][ T1315] R10: 0000001b32b20000 R11: 0000000000000246 R12: 00007ffe8ac53690 [ 32.496142][ T1315] R13: 00007f2937debfac R14: 0000000000007dfe R15: 00007f2937debfa0 [ 32.504135][ T1315] ---[ end trace 5d11b5392fd08ef5 ]---