BUG: unable to handle kernel NULL pointer dereference in generic_file_read_iter

Status: upstream: reported on 2026/10/21 00:01
Reported-by: syzbot+2ad6c9d51dda3cfba15d@syzkaller.appspotmail.com
First crash: 3d21h, last: 3d21h
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel NULL pointer dereference in generic_file_read_iter ntfs3 10 syz, C done 10 517d 562d 29/29 fixed on 2025/07/08 00:33

Sample crash report:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 300f9067 P4D 300f9067 PUD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8991 Comm: syz.3.1071 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc9000321f1f0 EFLAGS: 00010246
RAX: 1ffffffff15fd043 RBX: 1ffff92000643e69 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffffc9000321f330 RDI: ffffc9000321f2e0
RBP: ffffc9000321f330 R08: ffff88805943a157 R09: 1ffff1100b28742a
R10: dffffc0000000000 R11: ffffed100b28742b R12: ffffffff8afe8218
R13: ffff88805943a148 R14: ffffc9000321f2e0 R15: 0000000000001000
FS:  0000555583226500(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000000274e1000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 generic_file_read_iter+0x336/0x550 mm/filemap.c:2855
 __kernel_read+0x2e5/0x730 fs/read_write.c:428
 integrity_kernel_read+0x8a/0xd0 security/integrity/iint.c:221
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:485 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:516 [inline]
 ima_calc_file_hash+0xb1f/0x1960 security/integrity/ima/ima_crypto.c:573
 ima_collect_measurement+0x4d4/0xa30 security/integrity/ima/ima_api.c:290
 ima_update_xattr+0x17c/0x580 security/integrity/ima/ima_appraise.c:629
 ima_check_last_writer security/integrity/ima/ima_main.c:186 [inline]
 ima_file_free+0x326/0x4b0 security/integrity/ima/ima_main.c:210
 __fput+0x189/0x940 fs/file_table.c:412
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:180
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 __syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fafe059f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff201282d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fff201283c0 RCX: 00007fafe059f559
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000004b3fa R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2cb20000 R11: 0000000000000246 R12: 00007fff20128400
R13: 00007fafe0825fac R14: 000000000004b488 R15: 00007fafe0825fa0
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc9000321f1f0 EFLAGS: 00010246
RAX: 1ffffffff15fd043 RBX: 1ffff92000643e69 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffffc9000321f330 RDI: ffffc9000321f2e0
RBP: ffffc9000321f330 R08: ffff88805943a157 R09: 1ffff1100b28742a
R10: dffffc0000000000 R11: ffffed100b28742b R12: ffffffff8afe8218
R13: ffff88805943a148 R14: ffffc9000321f2e0 R15: 0000000000001000
FS:  0000555583226500(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000000274e1000 CR4: 00000000003526f0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/21 00:00 linux-6.6.y cecd39af8a1a df8746fb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: unable to handle kernel NULL pointer dereference in generic_file_read_iter
* Struck through repros no longer work on HEAD.