Warning: Permanently added '10.128.0.99' (ED25519) to the list of known hosts. 2026/09/13 02:06:01 parsed 1 programs 2026/09/13 02:06:01 serving rpc on tcp://42905 [ 24.383956][ T24] audit: type=1400 audit(1789265161.930:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.405340][ T24] audit: type=1400 audit(1789265161.930:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.425305][ T24] audit: type=1400 audit(1789265161.930:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.378728][ T24] audit: type=1400 audit(1789265162.920:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.382026][ T293] cgroup: Unknown subsys name 'net' [ 25.401620][ T24] audit: type=1400 audit(1789265162.920:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.428893][ T24] audit: type=1400 audit(1789265162.950:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.429356][ T293] cgroup: Unknown subsys name 'devices' [ 25.574503][ T293] cgroup: Unknown subsys name 'hugetlb' [ 25.580128][ T293] cgroup: Unknown subsys name 'rlimit' [ 25.700231][ T24] audit: type=1400 audit(1789265163.240:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.723621][ T24] audit: type=1400 audit(1789265163.240:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.744152][ T24] audit: type=1400 audit(1789265163.240:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.764493][ T24] audit: type=1400 audit(1789265163.240:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.785235][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 25.883776][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.333095][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 26.344109][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.694226][ T328] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.701334][ T328] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.709104][ T328] device bridge_slave_0 entered promiscuous mode [ 26.716224][ T328] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.723427][ T328] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.730772][ T328] device bridge_slave_1 entered promiscuous mode [ 26.773093][ T328] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.780147][ T328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.787482][ T328] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.794652][ T328] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.813243][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.821341][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.829043][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.843231][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.851558][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.858668][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.866194][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.874427][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.881470][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.890590][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.905731][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.919203][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.931654][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.939829][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.947358][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.956034][ T328] device veth0_vlan entered promiscuous mode [ 26.966890][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.976235][ T328] device veth1_macvtap entered promiscuous mode [ 26.985782][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.995840][ T336] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/09/13 02:06:05 executed programs: 0 [ 27.534119][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.541178][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.548751][ T365] device bridge_slave_0 entered promiscuous mode [ 27.556285][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.563475][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.570845][ T365] device bridge_slave_1 entered promiscuous mode [ 27.623683][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.630750][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.638084][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.645174][ T365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.663495][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.671045][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.678606][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.689136][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 27.697856][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.706567][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.713674][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.722149][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 27.730620][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.738918][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.746028][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.757710][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 27.765971][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.775575][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.783682][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.797395][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.805982][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.817153][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.825089][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.833625][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.841171][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.849874][ T365] device veth0_vlan entered promiscuous mode [ 27.859305][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.867443][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.876920][ T365] device veth1_macvtap entered promiscuous mode [ 27.886256][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.893956][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.902341][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.911903][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.920317][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.022925][ T391] ================================================================== [ 28.031156][ T391] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 28.037851][ T391] Write of size 8 at addr ffff888111010d50 by task syz.2.17/391 [ 28.045496][ T391] [ 28.047871][ T391] CPU: 1 PID: 391 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.054985][ T391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.065057][ T391] Call Trace: [ 28.068373][ T391] __dump_stack+0x21/0x24 [ 28.072725][ T391] dump_stack_lvl+0x1a7/0x208 [ 28.077416][ T391] ? show_regs_print_info+0x18/0x18 [ 28.082719][ T391] ? thaw_kernel_threads+0x220/0x220 [ 28.088022][ T391] print_address_description+0x7f/0x2c0 [ 28.093590][ T391] ? mutex_lock+0x85/0xf0 [ 28.097938][ T391] kasan_report+0x100/0x140 [ 28.102460][ T391] ? mutex_lock+0x85/0xf0 [ 28.106803][ T391] kasan_check_range+0x249/0x2a0 [ 28.111752][ T391] __kasan_check_write+0x14/0x20 [ 28.116782][ T391] mutex_lock+0x85/0xf0 [ 28.120975][ T391] ? mutex_trylock+0xb0/0xb0 [ 28.125614][ T391] ? l2tp_session_put+0xb2/0x1a0 [ 28.130652][ T391] ? l2tp_session_delete+0x3a9/0x4a0 [ 28.135967][ T391] pppol2tp_release+0x178/0x2b0 [ 28.140868][ T391] sock_close+0xb8/0x200 [ 28.145140][ T391] ? sock_mmap+0xa0/0xa0 [ 28.149497][ T391] __fput+0x2dc/0x730 [ 28.153502][ T391] ____fput+0x15/0x20 [ 28.157511][ T391] task_work_run+0x127/0x190 [ 28.162129][ T391] do_exit+0xa7c/0x24e0 [ 28.166319][ T391] ? put_task_struct+0x90/0x90 [ 28.171119][ T391] ? __kasan_check_write+0x14/0x20 [ 28.176254][ T391] ? __kasan_check_write+0x14/0x20 [ 28.181380][ T391] ? _raw_spin_lock_irq+0x95/0xf0 [ 28.186456][ T391] do_group_exit+0x149/0x310 [ 28.191064][ T391] ? __kasan_check_write+0x14/0x20 [ 28.196220][ T391] ? recalc_sigpending+0x1c4/0x230 [ 28.201347][ T391] get_signal+0xfb1/0x1300 [ 28.205784][ T391] arch_do_signal_or_restart+0xe7/0x11b0 [ 28.211437][ T391] ? __sched_text_start+0x8/0x8 [ 28.216304][ T391] ? __ia32_sys_rt_sigreturn+0x730/0x730 [ 28.221951][ T391] ? __kasan_check_read+0x11/0x20 [ 28.226996][ T391] ? preempt_schedule_common+0xbe/0xf0 [ 28.232473][ T391] ? __kasan_check_write+0x14/0x20 [ 28.237640][ T391] ? recalc_sigpending+0x1c4/0x230 [ 28.243080][ T391] exit_to_user_mode_loop+0xa2/0xe0 [ 28.248299][ T391] exit_to_user_mode_prepare+0x76/0xa0 [ 28.253774][ T391] syscall_exit_to_user_mode+0x1d/0x40 [ 28.259245][ T391] ret_from_fork+0x15/0x30 [ 28.263671][ T391] RIP: 0033:0x7f5163450159 [ 28.268103][ T391] Code: Unable to access opcode bytes at RIP 0x7