INFO: task kworker/1:8:5907 blocked for more than 159 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:8 state:D stack:19448 pid:5907 tgid:5907 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_power_efficient reg_check_chans_work Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ea/0x5050 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776 class_wiphy_constructor include/net/cfg80211.h:6360 [inline] reg_leave_invalid_chans net/wireless/reg.c:2441 [inline] reg_check_chans_work+0x15a/0xf40 net/wireless/reg.c:2456 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340 worker_thread+0xda6/0x1360 kernel/workqueue.c:3421 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 INFO: task kworker/u8:13:7635 blocked for more than 159 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:13 state:D stack:27336 pid:7635 tgid:7635 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: ipv6_addrconf addrconf_verify_work Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ea/0x5050 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776 rtnl_net_lock include/linux/rtnetlink.h:130 [inline] addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4734 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340 worker_thread+0xda6/0x1360 kernel/workqueue.c:3421 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Showing all locks held in the system: 1 lock held by kthreadd/2: 2 locks held by kworker/0:0/9: 4 locks held by kworker/0:1/10: 4 locks held by kworker/u8:0/12: #0: ffff888034bfa948 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff888034bfa948 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90000117bc0 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90000117bc0 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff8880346e9308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12f/0x830 drivers/net/wireguard/noise.c:529 #3: ffff88807d794890 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x140/0x830 drivers/net/wireguard/noise.c:530 3 locks held by kworker/u8:1/13: 4 locks held by kworker/1:0/24: 1 lock held by khungtaskd/31: #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 4 locks held by kworker/u8:2/36: 1 lock held by khugepaged/38: 4 locks held by kworker/1:1/39: #0: ffff88805783b948 ((wq_completion)wg-kex-wg1#7){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88805783b948 ((wq_completion)wg-kex-wg1#7){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90000af7bc0 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __ptr = (unsigned long) ((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90000af7bc0 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __ptr = (unsigned long) ((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff888057a59308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a1/0x9a0 drivers/net/wireguard/noise.c:598 #3: ffff88807d14c890 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x630/0x9a0 drivers/net/wireguard/noise.c:643 3 locks held by kworker/u8:3/50: 4 locks held by kworker/u8:4/65: 4 locks held by kworker/0:2/797: #0: ffff888142bedd48 ((wq_completion)wg-kex-wg1#4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff888142bedd48 ((wq_completion)wg-kex-wg1#4){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90003347bc0 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __ptr = (unsigned long) ((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90003347bc0 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __ptr = (unsigned long) ((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff888028161308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a1/0x9a0 drivers/net/wireguard/noise.c:598 #3: ffff88807d149708 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x58b/0x9a0 drivers/net/wireguard/noise.c:632 5 locks held by kworker/1:2/983: 3 locks held by kworker/u8:5/1100: 3 locks held by kworker/u8:6/2999: 5 locks held by kworker/R-mld/3182: 3 locks held by kworker/R-bat_e/3408: 4 locks held by kworker/u8:7/4244: 1 lock held by klogd/5183: 2 locks held by dhcpcd/5489: 2 locks held by crond/5563: 2 locks held by getty/5579: #0: ffff88814e0510a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211 2 locks held by syz-executor/5807: 3 locks held by kworker/1:3/5819: 4 locks held by syz-executor/5836: 4 locks held by syz-executor/5837: 2 locks held by syz-executor/5840: 1 lock held by syz-executor/5841: 4 locks held by kworker/1:4/5872: 2 locks held by kworker/1:5/5879: 3 locks held by kworker/1:6/5886: 2 locks held by kworker/0:3/5899: 3 locks held by kworker/1:7/5906: 4 locks held by kworker/1:8/5907: #0: ffff88813fe56948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88813fe56948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9000517fbc0 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9000517fbc0 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0xa5/0xf40 net/wireless/reg.c:2453 #3: ffff888028268788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6360 [inline] #3: ffff888028268788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_leave_invalid_chans net/wireless/reg.c:2441 [inline] #3: ffff888028268788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_check_chans_work+0x15a/0xf40 net/wireless/reg.c:2456 9 locks held by kworker/0:4/5929: 4 locks held by kworker/0:5/5931: 3 locks held by kworker/0:6/5933: 3 locks held by kworker/0:7/5942: 4 locks held by kworker/u8:8/6270: 1 lock held by syz.2.480/7612: #0: ffff8880349a5900 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:335 [inline] #0: ffff8880349a5900 (&mm->mmap_lock){++++}-{4:4}, at: __khugepaged_exit+0x165/0x460 mm/khugepaged.c:497 4 locks held by kworker/u8:9/7631: #0: ffff888034bfa948 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff888034bfa948 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9001b6dfbc0 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9001b6dfbc0 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff8880346e9308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12f/0x830 drivers/net/wireguard/noise.c:529 #3: ffff88807d795278 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x140/0x830 drivers/net/wireguard/noise.c:530 4 locks held by kworker/u8:10/7632: 4 locks held by kworker/u8:11/7633: #0: ffff888034bfb948 ((wq_completion)wg-kex-wg2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff888034bfb948 ((wq_completion)wg-kex-wg2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc900040afbc0 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc900040afbc0 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff888033c69308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12f/0x830 drivers/net/wireguard/noise.c:529 #3: ffff88807d7920f0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x140/0x830 drivers/net/wireguard/noise.c:530 3 locks held by kworker/u8:12/7634: 3 locks held by kworker/u8:13/7635: #0: ffff88802fd4e948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88802fd4e948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9001b32fbc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9001b32fbc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4734 4 locks held by kworker/u8:14/7636: 2 locks held by kworker/u8:15/7637: #0: ffff88813fe69948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88813fe69948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9001bcafbc0 ((work_completion)(&pool->idle_cull_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9001bcafbc0 ((work_completion)(&pool->idle_cull_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xf90/0xfe0 kernel/hung_task.c:515 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 3408 Comm: kworker/R-bat_e Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: bat_events batadv_tt_purge RIP: 0010:__this_cpu_preempt_check+0xe/0x20 lib/smp_processor_id.c:64 Code: aa 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 89 fe 48 c7 c7 00 3a 07 8c fd fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 RSP: 0018:ffffc90000a07698 EFLAGS: 00000246 RAX: 1ffff1100afeb401 RBX: 1ffff1100a06daf0 RCX: ffff888030e21e80 RDX: 0000000000000100 RSI: ffffffff8cbafd80 RDI: ffffffff8c073a00 RBP: 0000000000000000 R08: ffffffff8fef1b77 R09: 1ffffffff1fde36e R10: dffffc0000000000 R11: fffffbfff1fde36f R12: 0000000000000000 R13: ffffffff8c44a000 R14: ffff88805036d780 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8881257f5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000057604470 CR3: 0000000076f96000 CR4: 00000000003526f0 Call Trace: netdev_xmit_set_more include/linux/netdevice.h:5249 [inline] __netdev_start_xmit include/linux/netdevice.h:5272 [inline] netdev_start_xmit include/linux/netdevice.h:5282 [inline] xmit_one net/core/dev.c:3866 [inline] dev_hard_start_xmit+0x297/0x7f0 net/core/dev.c:3882 __dev_queue_xmit+0x168f/0x3850 net/core/dev.c:4832 dev_queue_xmit include/linux/netdevice.h:3381 [inline] br_dev_queue_push_xmit+0x6d2/0x8b0 net/bridge/br_forward.c:53 NF_HOOK+0x64e/0x6e0 include/linux/netfilter.h:318 br_nf_post_routing+0xb66/0xfe0 net/bridge/br_netfilter_hooks.c:966 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x23e/0x3f0 include/linux/netfilter.h:316 br_forward_finish+0xd3/0x130 net/bridge/br_forward.c:66 br_nf_hook_thresh net/bridge/br_netfilter_hooks.c:1167 [inline] br_nf_forward_finish+0xa5e/0xe90 net/bridge/br_netfilter_hooks.c:662 NF_HOOK+0x64e/0x6e0 include/linux/netfilter.h:318 br_nf_forward_ip+0x7ef/0xa30 net/bridge/br_netfilter_hooks.c:716 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x23e/0x3f0 include/linux/netfilter.h:316 __br_forward+0x397/0x540 net/bridge/br_forward.c:115 deliver_clone net/bridge/br_forward.c:131 [inline] maybe_deliver net/bridge/br_forward.c:191 [inline] br_flood+0x6ee/0xb80 net/bridge/br_forward.c:238 br_handle_frame_finish+0x1492/0x1b40 net/bridge/br_input.c:229 br_nf_hook_thresh+0x3dd/0x4c0 net/bridge/br_netfilter_hooks.c:-1 br_nf_pre_routing_finish_ipv6+0xa3a/0xd70 net/bridge/br_netfilter_ipv6.c:-1 NF_HOOK include/linux/netfilter.h:318 [inline] br_nf_pre_routing_ipv6+0x374/0x6f0 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0x1277/0x1510 net/bridge/br_input.c:442 __netif_receive_skb_core+0x98f/0x30a0 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x76d/0x1950 net/core/dev.c:6617 __napi_poll+0xae/0x340 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x627/0xf70 net/core/dev.c:7896 handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622 do_softirq+0x76/0xd0 kernel/softirq.c:523 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_global_purge net/batman-adv/translation-table.c:2250 [inline] batadv_tt_purge+0x4d1/0x9e0 net/batman-adv/translation-table.c:3510 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340 rescuer_thread+0xcba/0x1390 kernel/workqueue.c:3528 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246