syzkaller syzkaller login: [ 12.175290][ T24] kauditd_printk_skb: 48 callbacks suppressed [ 12.175300][ T24] audit: type=1400 audit(1783230505.239:59): avc: denied { transition } for pid=217 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.183510][ T24] audit: type=1400 audit(1783230505.239:60): avc: denied { noatsecure } for pid=217 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.188446][ T24] audit: type=1400 audit(1783230505.239:61): avc: denied { write } for pid=217 comm="sh" path="pipe:[13058]" dev="pipefs" ino=13058 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 12.194476][ T24] audit: type=1400 audit(1783230505.239:62): avc: denied { rlimitinh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.210924][ T24] audit: type=1400 audit(1783230505.239:63): avc: denied { siginh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.86' (ED25519) to the list of known hosts. 2026/07/05 05:48:34 parsed 1 programs 2026/07/05 05:48:34 serving rpc on tcp://34917 [ 21.135688][ T24] audit: type=1400 audit(1783230514.199:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 21.156446][ T24] audit: type=1400 audit(1783230514.199:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 21.176006][ T24] audit: type=1400 audit(1783230514.199:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 21.766133][ T24] audit: type=1400 audit(1783230514.829:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.767239][ T293] cgroup: Unknown subsys name 'net' [ 21.788808][ T24] audit: type=1400 audit(1783230514.829:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.816070][ T24] audit: type=1400 audit(1783230514.869:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.816244][ T293] cgroup: Unknown subsys name 'devices' [ 21.932390][ T293] cgroup: Unknown subsys name 'hugetlb' [ 21.938000][ T293] cgroup: Unknown subsys name 'rlimit' [ 22.081263][ T24] audit: type=1400 audit(1783230515.149:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.104433][ T24] audit: type=1400 audit(1783230515.149:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.124823][ T24] audit: type=1400 audit(1783230515.149:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.130515][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.145179][ T24] audit: type=1400 audit(1783230515.149:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.191195][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.623220][ T300] request_module fs-gadgetfs succeeded, but still no fs? [ 22.633807][ T300] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 23.130346][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.137433][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.145027][ T353] device bridge_slave_0 entered promiscuous mode [ 23.151973][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.159036][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.166563][ T353] device bridge_slave_1 entered promiscuous mode [ 23.199226][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.206289][ T353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.213603][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.220615][ T353] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.235898][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.243418][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.250667][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.260089][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.268305][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.275432][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.283813][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.292050][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.299081][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.310002][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.318936][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.331414][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.342392][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.350379][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.357920][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.366129][ T353] device veth0_vlan entered promiscuous mode [ 23.375138][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.383991][ T353] device veth1_macvtap entered promiscuous mode [ 23.393103][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.403035][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/05 05:48:36 executed programs: 0 [ 23.624006][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.631428][ T364] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.638874][ T364] device bridge_slave_0 entered promiscuous mode [ 23.646129][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.653271][ T364] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.660520][ T364] device bridge_slave_1 entered promiscuous mode [ 23.697810][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.705000][ T364] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.712270][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.719280][ T364] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.743674][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.751582][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.758727][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.767660][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.775800][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.782833][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.798667][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.806836][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.813973][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.829857][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.837993][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.846854][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.855154][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.867518][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.876150][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.891536][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.899452][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.908089][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.915838][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.923979][ T364] device veth0_vlan entered promiscuous mode [ 23.939826][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.947998][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.961467][ T364] device veth1_macvtap entered promiscuous mode [ 23.969504][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.977317][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.985982][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.995261][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.003564][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.031697][ T369] ================================================================== [ 24.039805][ T369] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 24.046468][ T369] Write of size 8 at addr ffff888111116950 by task syz.2.17/369 [ 24.054075][ T369] [ 24.056553][ T369] CPU: 1 PID: 369 Comm: syz.2.17 Not tainted syzkaller #0 [ 24.063652][ T369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 24.073696][ T369] Call Trace: [ 24.076972][ T369] __dump_stack+0x21/0x24 [ 24.081280][ T369] dump_stack_lvl+0x1a7/0x208 [ 24.085935][ T369] ? show_regs_print_info+0x18/0x18 [ 24.091111][ T369] ? thaw_kernel_threads+0x220/0x220 [ 24.096372][ T369] ? debug_smp_processor_id+0x17/0x20 [ 24.101722][ T369] print_address_description+0x7f/0x2c0 [ 24.107248][ T369] ? mutex_lock+0x85/0xf0 [ 24.111553][ T369] kasan_report+0x100/0x140 [ 24.116033][ T369] ? mutex_lock+0x85/0xf0 [ 24.120361][ T369] kasan_check_range+0x249/0x2a0 [ 24.125339][ T369] __kasan_check_write+0x14/0x20 [ 24.130256][ T369] mutex_lock+0x85/0xf0 [ 24.134392][ T369] ? mutex_trylock+0xb0/0xb0 [ 24.138957][ T369] ? l2tp_session_put+0xb2/0x1a0 [ 24.143883][ T369] ? l2tp_session_delete+0x3a9/0x4a0 [ 24.149147][ T369] pppol2tp_release+0x178/0x2b0 [ 24.153992][ T369] sock_close+0xb8/0x200 [ 24.158222][ T369] ? sock_mmap+0xa0/0xa0 [ 24.162457][ T369] __fput+0x2dc/0x730 [ 24.166417][ T369] ____fput+0x15/0x20 [ 24.170375][ T369] task_work_run+0x127/0x190 [ 24.174942][ T369] exit_to_user_mode_loop+0xcb/0xe0 [ 24.180114][ T369] exit_to_user_mode_prepare+0x76/0xa0 [ 24.185554][ T369] syscall_exit_to_user_mode+0x1d/0x40 [ 24.190994][ T369] do_syscall_64+0x3d/0x40 [ 24.195388][ T369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.201252][ T369] RIP: 0033:0x7f7f73d83e59 [ 24.205651][ T369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.225248][ T369] RSP: 002b:00007ffd47307c28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 24.233661][ T369] RAX: 0000000000000000 RBX: 00007ffd47307d10 RCX: 00007f7f73d83e59 [ 24.241623][ T369] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 24.249577][ T369] RBP: 0000000000005dc9 R08: 0000000000000001 R09: 0000000000000000 [ 24.257576][ T369] R10: 0000001b32b20000 R11: 0000000000000246 R12: 0000000000000000 [ 24.265536][ T369] R13: 00007f7f7400bfac R14: 00007f7f7400bfa8 R15: 00007f7f7400bfa0 [ 24.273489][ T369] [ 24.275797][ T369] Allocated by task 369: [ 24.280016][ T369] __kasan_kmalloc+0xd4/0x100 [ 24.284676][ T369] __kmalloc+0x19f/0x330 [ 24.288898][ T369] l2tp_session_create+0x39/0xb60 [ 24.293902][ T369] pppol2tp_connect+0xbf5/0x1640 [ 24.298819][ T369] __sys_connect+0x3ce/0x450 [ 24.303396][ T369] __x64_sys_connect+0x7a/0x90 [ 24.308137][ T369] do_syscall_64+0x31/0x40 [ 24.312537][ T369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.318400][ T369] [ 24.320701][ T369] Freed by task 369: [ 24.324589][ T369] kasan_set_track+0x4a/0x70 [ 24.329281][ T369] kasan_set_free_info+0x23/0x40 [ 24.334205][ T369] ____kasan_slab_free+0x125/0x160 [ 24.339296][ T369] __kasan_slab_free+0x11/0x20 [ 24.344036][ T369] slab_free_freelist_hook+0xc5/0x190 [ 24.349384][ T369] kfree+0xc0/0x270 [ 24.353168][ T369] l2tp_session_put+0xb2/0x1a0 [ 24.357907][ T369] l2tp_session_delete+0x3a9/0x4a0 [ 24.363002][ T369] pppol2tp_release+0x169/0x2b0 [ 24.367833][ T369] sock_close+0xb8/0x200 [ 24.372051][ T369] __fput+0x2dc/0x730 [ 24.376007][ T369] ____fput+0x15/0x20 [ 24.379965][ T369] task_work_run+0x127/0x190 [ 24.384537][ T369] exit_to_user_mode_loop+0xcb/0xe0 [ 24.389711][ T369] exit_to_user_mode_prepare+0x76/0xa0 [ 24.395151][ T369] syscall_exit_to_user_mode+0x1d/0x40 [ 24.400580][ T369] do_syscall_64+0x3d/0x40 [ 24.404971][ T369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.410846][ T369] [ 24.413163][ T369] The buggy address belongs to the object at ffff888111116800 [ 24.413163][ T369] which belongs to the cache kmalloc-512 of size 512 [ 24.427197][ T369] The buggy address is located 336 bytes inside of [ 24.427197][ T369] 512-byte region [ffff888111116800, ffff888111116a00) [ 24.440455][ T369] The buggy address belongs to the page: [ 24.446108][ T369] page:ffffea0004444500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111114 [ 24.456325][ T369] head:ffffea0004444500 order:2 compound_mapcount:0 compound_pincount:0 [ 24.464647][ T369] flags: 0x4000000000010200(slab|head) [ 24.470086][ T369] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 24.478679][ T369] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 24.487244][ T369] page dumped because: kasan: bad access detected [ 24.493634][ T369] page_owner tracks the page as allocated [ 24.499334][ T369] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 364, ts 24022287881, free_ts 23985768723 [ 24.519710][ T369] prep_new_page+0x176/0x190 [ 24.524279][ T369] get_page_from_freelist+0x225f/0x23f0 [ 24.529800][ T369] __alloc_pages_nodemask+0x29a/0x640 [ 24.535152][ T369] new_slab+0x84/0x3f0 [ 24.539198][ T369] ___slab_alloc+0x2f8/0x4c0 [ 24.543768][ T369] __slab_alloc+0x63/0xa0 [ 24.548073][ T369] __kmalloc+0x1f9/0x330 [ 24.552291][ T369] fib6_info_alloc+0x34/0xe0 [ 24.556866][ T369] ip6_route_info_create+0x4c7/0x1450 [ 24.562212][ T369] ip6_route_add+0x27/0x130 [ 24.566691][ T369] addrconf_add_dev+0x385/0x4c0 [ 24.571518][ T369] addrconf_dev_config+0x1c3/0x510 [ 24.576667][ T369] addrconf_notify+0x9d8/0xea0 [ 24.581430][ T369] raw_notifier_call_chain+0x90/0x100 [ 24.586790][ T369] __dev_notify_flags+0x2f4/0x5b0 [ 24.591792][ T369] dev_change_flags+0xe3/0x1a0 [ 24.596529][ T369] page last free stack trace: [ 24.601181][ T369] __free_pages_ok+0x80b/0x830 [ 24.605923][ T369] __free_pages+0xd8/0x390 [ 24.610316][ T369] __free_slab+0xcf/0x190 [ 24.614620][ T369] unfreeze_partials+0x150/0x180 [ 24.619536][ T369] put_cpu_partial+0xc1/0x180 [ 24.624192][ T369] __slab_free+0x2c9/0x3a0 [ 24.628589][ T369] ___cache_free+0x10e/0x130 [ 24.633157][ T369] qlink_free+0x50/0x90 [ 24.637288][ T369] qlist_free_all+0x5f/0xb0 [ 24.641770][ T369] kasan_quarantine_reduce+0x14a/0x160 [ 24.647204][ T369] __kasan_slab_alloc+0x2f/0xe0 [ 24.652038][ T369] slab_post_alloc_hook+0x5d/0x2f0 [ 24.657126][ T369] __kmalloc+0x17b/0x330 [ 24.661346][ T369] fib6_info_alloc+0x34/0xe0 [ 24.665914][ T369] ip6_route_info_create+0x4c7/0x1450 [ 24.671262][ T369] ip6_route_add+0x27/0x130 [ 24.675770][ T369] [ 24.678074][ T369] Memory state around the buggy address: [ 24.683684][ T369] ffff888111116800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.691722][ T369] ffff888111116880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.699761][ T369] >ffff888111116900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.707806][ T369] ^ [ 24.714460][ T369] ffff888111116980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.722504][ T369] ffff888111116a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.730567][ T369] ================================================================== [ 24.738603][ T369] Disabling lock debugging due to kernel taint