kernel BUG in submit_bh_wbc

Status: upstream: reported C repro on 2026/08/11 15:13
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+0e25ce8d777866a3bd1d@syzkaller.appspotmail.com
First crash: 70d, last: 22d
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2026/09/28 linux-6.6.y (ToT) 79643295eba1 C [report] kernel BUG in submit_bh_wbc
2026/09/28 upstream (ToT) 72d3fcf802c4 C Didn't crash
▶ ▼ Similar bugs (11)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 kernel BUG in submit_bh_wbc origin:lts-only -1 syz, C done 19 866d 1294d 3/3 fixed on 2024/07/20 06:27
upstream kernel BUG at fs/buffer.c:LINE! nilfs -1 syz, C done error 567 924d 3106d 25/29 fixed on 2024/04/10 03:59
upstream kernel BUG in submit_bh_wbc (2) udf -1 syz, C done 123 803d 908d 27/29 fixed on 2024/08/14 03:44
linux-4.14 kernel BUG at fs/buffer.c:LINE! -1 syz, C error 59 1338d 2733d 0/1 upstream: reported C repro on 2019/04/27 19:47
linux-6.1 kernel BUG in submit_bh_wbc (2) origin:lts-only -1 syz, C inconclusive 290 24d 816d 0/3 upstream: reported C repro on 2024/07/26 16:49
linux-4.19 kernel BUG at fs/buffer.c:LINE! (2) udf ext4 -1 syz, C error 31 1345d 2159d 0/1 upstream: reported C repro on 2020/11/21 07:48
android-54 kernel BUG at fs/buffer.c:LINE! ext4 -1 syz, C 4762 514d 2464d 0/2 upstream: reported C repro on 2020/01/21 13:12
upstream kernel BUG in submit_bh_wbc (3) nilfs fs -1 syz, C done 18 729d 736d 28/29 fixed on 2024/11/12 23:31
linux-5.15 kernel BUG in submit_bh_wbc -1 syz, C error 8 956d 1234d 0/3 auto-obsoleted due to no activity on 2024/06/16 14:58
upstream kernel BUG in submit_bh_wbc nilfs -1 syz, C done 10 909d 918d 25/29 fixed on 2024/04/24 18:26
android-6-1 kernel BUG in submit_bh_wbc missing-backport origin:lts -1 syz, C done done 2640 1d08h 1223d 0/2 upstream: reported C repro on 2023/06/15 00:20
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2026/10/03 01:27 1h48m fix candidate upstream OK (0) job log

Sample crash report:
------------[ cut here ]------------
kernel BUG at fs/buffer.c:2795!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5930 Comm: kmmpd-loop0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:submit_bh_wbc+0x566/0x580 fs/buffer.c:2795
Code: e8 cf eb 87 ff be 00 10 00 00 48 c7 c7 e0 74 26 8d 4c 89 ea e8 5b d8 67 02 e9 8b fe ff ff e8 b1 eb 87 ff 0f 0b e8 aa eb 87 ff <0f> 0b e8 a3 eb 87 ff 0f 0b e8 9c eb 87 ff 0f 0b e8 95 eb 87 ff 0f
RSP: 0018:ffffc90003347cc0 EFLAGS: 00010293
RAX: ffffffff81ff9fa6 RBX: 0000000000000000 RCX: ffff88802bb8da00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000003801 R08: ffff88807493c917 R09: 1ffff1100e927922
R10: dffffc0000000000 R11: ffffed100e927923 R12: 1ffff1100e927922
R13: 0000000000000000 R14: ffff88807493c910 R15: ffff88802495e000
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555559e36a78 CR3: 000000000cf32000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 write_mmp_block_thawed+0x3b1/0x540 fs/ext4/mmp.c:51
 write_mmp_block+0x129/0x390 fs/ext4/mmp.c:67
 kmmpd+0x344/0x990 fs/ext4/mmp.c:178
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:submit_bh_wbc+0x566/0x580 fs/buffer.c:2795
Code: e8 cf eb 87 ff be 00 10 00 00 48 c7 c7 e0 74 26 8d 4c 89 ea e8 5b d8 67 02 e9 8b fe ff ff e8 b1 eb 87 ff 0f 0b e8 aa eb 87 ff <0f> 0b e8 a3 eb 87 ff 0f 0b e8 9c eb 87 ff 0f 0b e8 95 eb 87 ff 0f
RSP: 0018:ffffc90003347cc0 EFLAGS: 00010293
RAX: ffffffff81ff9fa6 RBX: 0000000000000000 RCX: ffff88802bb8da00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000003801 R08: ffff88807493c917 R09: 1ffff1100e927922
R10: dffffc0000000000 R11: ffffed100e927923 R12: 1ffff1100e927922
R13: 0000000000000000 R14: ffff88807493c910 R15: ffff88802495e000
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561c68e0ea38 CR3: 000000002e0ba000 CR4: 00000000003506f0

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/17 16:13 linux-6.6.y 79643295eba1 95928915 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-6-kasan kernel BUG in submit_bh_wbc
2026/09/17 02:17 linux-6.6.y 79643295eba1 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan kernel BUG in submit_bh_wbc
2026/09/09 07:25 linux-6.6.y 8b73de7da85f 8387c273 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan kernel BUG in submit_bh_wbc
2026/08/11 15:12 linux-6.6.y d27334b2888c 71790083 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan kernel BUG in submit_bh_wbc
* Struck through repros no longer work on HEAD.