Warning: Permanently added '10.128.0.232' (ED25519) to the list of known hosts. 2026/08/05 18:08:30 parsed 1 programs 2026/08/05 18:08:30 serving rpc on tcp://46865 [ 22.912502][ T24] audit: type=1400 audit(1785953310.969:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 22.933232][ T24] audit: type=1400 audit(1785953310.969:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 22.952960][ T24] audit: type=1400 audit(1785953310.969:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 23.518676][ T24] audit: type=1400 audit(1785953311.569:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.519699][ T293] cgroup: Unknown subsys name 'net' [ 23.541339][ T24] audit: type=1400 audit(1785953311.569:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.568660][ T24] audit: type=1400 audit(1785953311.609:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.568832][ T293] cgroup: Unknown subsys name 'devices' [ 23.680899][ T293] cgroup: Unknown subsys name 'hugetlb' [ 23.686498][ T293] cgroup: Unknown subsys name 'rlimit' [ 23.828751][ T24] audit: type=1400 audit(1785953311.879:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.851904][ T24] audit: type=1400 audit(1785953311.879:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.872458][ T24] audit: type=1400 audit(1785953311.879:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.873049][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.892897][ T24] audit: type=1400 audit(1785953311.879:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.921465][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.287686][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 24.298180][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 24.733147][ T343] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.740234][ T343] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.747550][ T343] device bridge_slave_0 entered promiscuous mode [ 24.754619][ T343] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.761949][ T343] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.769677][ T343] device bridge_slave_1 entered promiscuous mode [ 24.802745][ T343] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.809785][ T343] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.817013][ T343] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.824040][ T343] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.839039][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.846949][ T318] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.854211][ T318] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.863332][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.871581][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.878598][ T318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.886911][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.895314][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.902352][ T318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.913491][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.922644][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.934717][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.945240][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.953471][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.960954][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.968790][ T343] device veth0_vlan entered promiscuous mode [ 24.978038][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.986930][ T343] device veth1_macvtap entered promiscuous mode [ 24.995654][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.004973][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/08/05 18:08:33 executed programs: 0 [ 25.257270][ T363] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.264372][ T363] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.271777][ T363] device bridge_slave_0 entered promiscuous mode [ 25.278701][ T363] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.285848][ T363] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.293177][ T363] device bridge_slave_1 entered promiscuous mode [ 25.330538][ T363] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.337576][ T363] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.344968][ T363] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.352012][ T363] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.371783][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.379265][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.386551][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.395785][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.404195][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.411243][ T353] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.420041][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.428165][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.435194][ T353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.451898][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.460876][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.473307][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.488588][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.497019][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.504551][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.512924][ T363] device veth0_vlan entered promiscuous mode [ 25.525309][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.534325][ T363] device veth1_macvtap entered promiscuous mode [ 25.543004][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.552525][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.630455][ T368] ================================================================== [ 25.638558][ T368] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 25.645224][ T368] Write of size 8 at addr ffff88810fc9d550 by task syz.2.17/368 [ 25.652836][ T368] [ 25.655169][ T368] CPU: 1 PID: 368 Comm: syz.2.17 Not tainted syzkaller #0 [ 25.662262][ T368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.672310][ T368] Call Trace: [ 25.675605][ T368] __dump_stack+0x21/0x24 [ 25.679928][ T368] dump_stack_lvl+0x1a7/0x208 [ 25.684601][ T368] ? show_regs_print_info+0x18/0x18 [ 25.689803][ T368] ? thaw_kernel_threads+0x220/0x220 [ 25.695173][ T368] print_address_description+0x7f/0x2c0 [ 25.700885][ T368] ? mutex_lock+0x85/0xf0 [ 25.705204][ T368] kasan_report+0x100/0x140 [ 25.709687][ T368] ? mutex_lock+0x85/0xf0 [ 25.713987][ T368] kasan_check_range+0x249/0x2a0 [ 25.718986][ T368] __kasan_check_write+0x14/0x20 [ 25.723902][ T368] mutex_lock+0x85/0xf0 [ 25.728031][ T368] ? mutex_trylock+0xb0/0xb0 [ 25.732601][ T368] ? l2tp_session_put+0xb2/0x1a0 [ 25.737513][ T368] ? l2tp_session_delete+0x3a9/0x4a0 [ 25.742785][ T368] pppol2tp_release+0x178/0x2b0 [ 25.747619][ T368] sock_close+0xb8/0x200 [ 25.751847][ T368] ? sock_mmap+0xa0/0xa0 [ 25.756064][ T368] __fput+0x2dc/0x730 [ 25.760022][ T368] ____fput+0x15/0x20 [ 25.764334][ T368] task_work_run+0x127/0x190 [ 25.768905][ T368] do_exit+0xa7c/0x24e0 [ 25.773041][ T368] ? finish_task_switch+0x1b7/0x5a0 [ 25.778217][ T368] ? switch_mm_irqs_off+0x752/0x990 [ 25.783390][ T368] ? put_task_struct+0x90/0x90 [ 25.788129][ T368] ? remove_hrtimer+0x1aa/0x490 [ 25.792954][ T368] ? __kasan_check_write+0x14/0x20 [ 25.798046][ T368] ? _raw_spin_lock_irq+0x95/0xf0 [ 25.803052][ T368] do_group_exit+0x149/0x310 [ 25.807616][ T368] ? __kasan_check_write+0x14/0x20 [ 25.812702][ T368] ? recalc_sigpending+0x1c4/0x230 [ 25.817786][ T368] get_signal+0xfb1/0x1300 [ 25.822180][ T368] arch_do_signal_or_restart+0xe7/0x11b0 [ 25.827785][ T368] ? nanosleep_copyout+0x120/0x120 [ 25.832871][ T368] ? get_timespec64+0x116/0x1b0 [ 25.837696][ T368] ? __ia32_sys_rt_sigreturn+0x730/0x730 [ 25.843300][ T368] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 25.848905][ T368] ? debug_smp_processor_id+0x17/0x20 [ 25.854251][ T368] exit_to_user_mode_loop+0xa2/0xe0 [ 25.859512][ T368] exit_to_user_mode_prepare+0x76/0xa0 [ 25.864950][ T368] syscall_exit_to_user_mode+0x1d/0x40 [ 25.870384][ T368] do_syscall_64+0x3d/0x40 [ 25.874776][ T368] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.880644][ T368] RIP: 0033:0x7f8df7ebe197 [ 25.885124][ T368] Code: Unable to access opcode bytes at RIP 0x7f8df7ebe16d. [ 25.892570][ T368] RSP: 002b:00007ffc0d443780 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 25.900962][ T368] RAX: fffffffffffffdfc RBX: 000055557273c500 RCX: 00007f8df7ebe197 [ 25.909096][ T368] RDX: 00007ffc0d4437c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.917144][ T368] RBP: 00007f8df7f9a00c R08: 0000000000000000 R09: 0000000000000000 [ 25.925165][ T368] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 25.933122][ T368] R13: 00007f8df818afac R14: 00007f8df818afa0 R15: 00007f8df818afa0 [ 25.941336][ T368] [ 25.943641][ T368] Allocated by task 367: [ 25.947863][ T368] __kasan_kmalloc+0xd4/0x100 [ 25.952514][ T368] __kmalloc+0x19f/0x330 [ 25.956746][ T368] l2tp_session_create+0x39/0xb60 [ 25.961748][ T368] pppol2tp_connect+0xbf5/0x1640 [ 25.966657][ T368] __sys_connect+0x3ce/0x450 [ 25.971218][ T368] __x64_sys_connect+0x7a/0x90 [ 25.975973][ T368] do_syscall_64+0x31/0x40 [ 25.980364][ T368] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.986228][ T368] [ 25.988530][ T368] Freed by task 368: [ 25.992436][ T368] kasan_set_track+0x4a/0x70 [ 25.997005][ T368] kasan_set_free_info+0x23/0x40 [ 26.001915][ T368] ____kasan_slab_free+0x125/0x160 [ 26.007086][ T368] __kasan_slab_free+0x11/0x20 [ 26.012132][ T368] slab_free_freelist_hook+0xc5/0x190 [ 26.017497][ T368] kfree+0xc0/0x270 [ 26.021293][ T368] l2tp_session_put+0xb2/0x1a0 [ 26.026044][ T368] l2tp_session_delete+0x3a9/0x4a0 [ 26.031133][ T368] pppol2tp_release+0x169/0x2b0 [ 26.035982][ T368] sock_close+0xb8/0x200 [ 26.040203][ T368] __fput+0x2dc/0x730 [ 26.044162][ T368] ____fput+0x15/0x20 [ 26.048119][ T368] task_work_run+0x127/0x190 [ 26.052692][ T368] do_exit+0xa7c/0x24e0 [ 26.056827][ T368] do_group_exit+0x149/0x310 [ 26.061392][ T368] get_signal+0xfb1/0x1300 [ 26.065782][ T368] arch_do_signal_or_restart+0xe7/0x11b0 [ 26.071397][ T368] exit_to_user_mode_loop+0xa2/0xe0 [ 26.076704][ T368] exit_to_user_mode_prepare+0x76/0xa0 [ 26.082159][ T368] syscall_exit_to_user_mode+0x1d/0x40 [ 26.087619][ T368] do_syscall_64+0x3d/0x40 [ 26.092028][ T368] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.097906][ T368] [ 26.100225][ T368] The buggy address belongs to the object at ffff88810fc9d400 [ 26.100225][ T368] which belongs to the cache kmalloc-512 of size 512 [ 26.114271][ T368] The buggy address is located 336 bytes inside of [ 26.114271][ T368] 512-byte region [ffff88810fc9d400, ffff88810fc9d600) [ 26.127526][ T368] The buggy address belongs to the page: [ 26.133158][ T368] page:ffffea00043f2700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fc9c [ 26.143366][ T368] head:ffffea00043f2700 order:2 compound_mapcount:0 compound_pincount:0 [ 26.151673][ T368] flags: 0x4000000000010200(slab|head) [ 26.157108][ T368] raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100043080 [ 26.165749][ T368] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 26.174392][ T368] page dumped because: kasan: bad access detected [ 26.181482][ T368] page_owner tracks the page as allocated [ 26.187277][ T368] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 96, ts 4196710303, free_ts 0 [ 26.205307][ T368] prep_new_page+0x176/0x190 [ 26.209979][ T368] get_page_from_freelist+0x225f/0x23f0 [ 26.215500][ T368] __alloc_pages_nodemask+0x29a/0x640 [ 26.220934][ T368] new_slab+0x84/0x3f0 [ 26.224976][ T368] ___slab_alloc+0x2f8/0x4c0 [ 26.229541][ T368] __slab_alloc+0x63/0xa0 [ 26.233849][ T368] __kmalloc_track_caller+0x1e4/0x310 [ 26.239195][ T368] __alloc_skb+0xdc/0x520 [ 26.243500][ T368] alloc_uevent_skb+0x85/0x240 [ 26.248241][ T368] kobject_uevent_net_broadcast+0x335/0x5a0 [ 26.254109][ T368] kobject_uevent_env+0x52b/0x700 [ 26.259112][ T368] kobject_synth_uevent+0x452/0x940 [ 26.264284][ T368] store_uevent+0x16/0x30 [ 26.268616][ T368] module_attr_store+0x5f/0x80 [ 26.273383][ T368] sysfs_kf_write+0x129/0x150 [ 26.278150][ T368] kernfs_fop_write_iter+0x2bd/0x400 [ 26.283422][ T368] page_owner free stack trace missing [ 26.288778][ T368] [ 26.291085][ T368] Memory state around the buggy address: [ 26.296706][ T368] ffff88810fc9d400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.304798][ T368] ffff88810fc9d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.312957][ T368] >ffff88810fc9d500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.322260][ T368] ^ [ 26.328921][ T368] ffff88810fc9d580: fb fb fb fb f