RSP: 002b:00007ffe6719abd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000067 RAX: ffffffffffffffda RBX: 00007fd2bcaf1490 RCX: 00007fd2bc951a37 RDX: 00000000000003ff RSI: 00007fd2bcaf1490 RDI: 0000000000000002 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000004000 R11: 0000000000000206 R12: 00007fd2bcaf1490 R13: 00007fd2bcacedfe R14: 00007fd2bcaf188a R15: 00007fd2bcaf188a BUG: unable to handle page fault for address: ffffed1800000004 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 23fff2067 P4D 23fff2067 PUD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 90 Comm: klogd Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:__rb_change_child include/linux/rbtree_augmented.h:173 [inline] RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:283 [inline] RIP: 0010:rb_erase_augmented include/linux/rbtree_augmented.h:303 [inline] RIP: 0010:rb_erase_augmented_cached include/linux/rbtree_augmented.h:314 [inline] RIP: 0010:vma_interval_tree_remove+0x788/0xaf0 mm/interval_tree.c:23 Code: 4c 89 fb 48 83 e3 fc 0f 84 a8 00 00 00 4c 89 7d d0 4c 89 65 c8 4c 8d 63 10 4d 89 e7 49 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <41> 80 3c 07 00 74 08 4c 89 e7 e8 c9 7d 0c 00 48 8b 45 b8 49 39 04 RSP: 0018:ffffc900009b7a80 EFLAGS: 00010a02 RAX: dffffc0000000000 RBX: ffff88c000000010 RCX: ffff88810d78cf00 RDX: 0000000000000000 RSI: ffff88c000000010 RDI: 0000000000000000 RBP: ffffc900009b7ad8 R08: ffff8881092ef26f R09: 1ffff1102125de4d R10: dffffc0000000000 R11: ffffed102125de4e R12: ffff88c000000020 R13: ffff88810deb4d10 R14: ffff88810deb4d10 R15: 1ffff11800000004 FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffed1800000004 CR3: 000000010d719000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __remove_shared_vm_struct mm/mmap.c:160 [inline] unlink_file_vma+0xda/0xf0 mm/mmap.c:175 free_pgtables+0x139/0x280 mm/memory.c:492 exit_mmap+0x433/0x8b0 mm/mmap.c:3247 __mmput+0x92/0x300 kernel/fork.c:1185 mmput+0x50/0x150 kernel/fork.c:1208 exit_mm kernel/exit.c:555 [inline] do_exit+0xacc/0x29a0 kernel/exit.c:877 do_group_exit+0x149/0x310 kernel/exit.c:1004 __do_sys_exit_group kernel/exit.c:1015 [inline] __se_sys_exit_group kernel/exit.c:1013 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1013 x64_sys_call+0x832/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fd2bc9216c5 Code: Unable to access opcode bytes at RIP 0x7fd2bc92169b. RSP: 002b:00007ffe6719abc8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007fd2bca22fe8 RCX: 00007fd2bc9216c5 RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000001 RBP: 0000000000000001 R08: 00007ffe6719ab58 R09: 0000000000000000 R10: 00007ffe6719a9f0 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000000001 R14: 00007fd2bca21680 R15: 00007fd2bca23000 Modules linked in: CR2: ffffed1800000004 ---[ end trace 297583d5c718bc6d ]--- RIP: 0010:__rb_change_child include/linux/rbtree_augmented.h:173 [inline] RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:283 [inline] RIP: 0010:rb_erase_augmented include/linux/rbtree_augmented.h:303 [inline] RIP: 0010:rb_erase_augmented_cached include/linux/rbtree_augmented.h:314 [inline] RIP: 0010:vma_interval_tree_remove+0x788/0xaf0 mm/interval_tree.c:23 Code: 4c 89 fb 48 83 e3 fc 0f 84 a8 00 00 00 4c 89 7d d0 4c 89 65 c8 4c 8d 63 10 4d 89 e7 49 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <41> 80 3c 07 00 74 08 4c 89 e7 e8 c9 7d 0c 00 48 8b 45 b8 49 39 04 RSP: 0018:ffffc900009b7a80 EFLAGS: 00010a02 RAX: dffffc0000000000 RBX: ffff88c000000010 RCX: ffff88810d78cf00 RDX: 0000000000000000 RSI: ffff88c000000010 RDI: 0000000000000000 RBP: ffffc900009b7ad8 R08: ffff8881092ef26f R09: 1ffff1102125de4d R10: dffffc0000000000 R11: ffffed102125de4e R12: ffff88c000000020 R13: ffff88810deb4d10 R14: ffff88810deb4d10 R15: 1ffff11800000004 FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffed1800000004 CR3: 000000010d719000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 4c 89 fb mov %r15,%rbx 3: 48 83 e3 fc and $0xfffffffffffffffc,%rbx 7: 0f 84 a8 00 00 00 je 0xb5 d: 4c 89 7d d0 mov %r15,-0x30(%rbp) 11: 4c 89 65 c8 mov %r12,-0x38(%rbp) 15: 4c 8d 63 10 lea 0x10(%rbx),%r12 19: 4d 89 e7 mov %r12,%r15 1c: 49 c1 ef 03 shr $0x3,%r15 20: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 27: fc ff df * 2a: 41 80 3c 07 00 cmpb $0x0,(%r15,%rax,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 4c 89 e7 mov %r12,%rdi 34: e8 c9 7d 0c 00 call 0xc7e02 39: 48 8b 45 b8 mov -0x48(%rbp),%rax 3d: 49 rex.WB 3e: 39 .byte 0x39 3f: 04 .byte 0x4