KASAN: slab-use-after-free Read in __setup_irq

Status: upstream: reported on 2026/09/23 23:13
Subsystems: kernel
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+843bf2f48f4d12e6682e@syzkaller.appspotmail.com
First crash: 47d, last: 1d18h
▶ ▼ ✨ AI Jobs (4)
ID Workflow Result Correct Bug Created Started Finished Revision
d8c84012 repro-c 💥 KASAN: slab-use-after-free Read in __setup_irq 2026/08/15 11:44 2026/08/15 11:44 2026/08/15 18:28 746171ee
ac9b0e08 moderation Actionable: ❌ ❓ KASAN: slab-use-after-free Read in __setup_irq 2026/08/15 00:01 2026/08/15 00:01 2026/08/15 00:03 746171ee
64a25f2f repro-c 💥 KASAN: slab-use-after-free Read in __setup_irq 2026/08/14 15:13 2026/08/14 15:13 2026/08/14 22:52 746171ee
07a59ca5 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ ❓ KASAN: slab-use-after-free Read in __setup_irq 2026/08/12 03:28 2026/08/12 03:28 2026/08/12 04:14 f8d35649
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] serial: core: shut down initialized port on removal 3 (3) 2026/09/26 13:05
[syzbot] [kernel?] KASAN: slab-use-after-free Read in __setup_irq 0 (1) 2026/09/23 23:13
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.6 KASAN: slab-use-after-free Read in __setup_irq 19 2 1d14h 3d18h 0/2 upstream: reported on 2026/09/23 02:54

Sample crash report:
netlink: 'syz.1.1933': attribute type 16 has an invalid length.
==================================================================
BUG: KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: slab-use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888025daf300 by task syz.1.1933/13580

CPU: 0 UID: 0 PID: 13580 Comm: syz.1.1933 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 string_nocheck lib/vsprintf.c:648 [inline]
 string+0x216/0x2d0 lib/vsprintf.c:730
 vsnprintf+0x74a/0xef0 lib/vsprintf.c:2949
 vprintk_store+0x3d9/0xdc0 kernel/printk/printk.c:2307
 vprintk_emit+0x192/0x560 kernel/printk/printk.c:2455
 _printk+0xdd/0x130 kernel/printk/printk.c:2504
 __setup_irq+0x12a1/0x20a0 kernel/irq/manage.c:1821
 request_threaded_irq+0x2c1/0x3a0 kernel/irq/manage.c:2184
 request_irq include/linux/interrupt.h:176 [inline]
 pcl812_attach+0x254/0x22b0 drivers/comedi/drivers/pcl812.c:1174
 comedi_device_attach+0x535/0x730 drivers/comedi/drivers.c:1101
 do_devconfig_ioctl drivers/comedi/comedi_fops.c:930 [inline]
 comedi_unlocked_ioctl+0x8f4/0x1af0 drivers/comedi/comedi_fops.c:2302
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd9fda4e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd9fbca6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fd9fdcd5fa0 RCX: 00007fd9fda4e159
RDX: 0000200000000240 RSI: 0000000040946400 RDI: 0000000000000003
RBP: 00007fd9fdae506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd9fdcd6038 R14: 00007fd9fdcd5fa0 R15: 00007ffc9d582bd8
 </TASK>

Allocated by task 1:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_node_track_caller_noprof+0x56e/0x7b0 mm/slub.c:5545
 kvasprintf+0xeb/0x1a0 lib/kasprintf.c:25
 kasprintf+0xe2/0x140 lib/kasprintf.c:59
 serial_core_add_one_port drivers/tty/serial/serial_core.c:3106 [inline]
 serial_core_register_port+0x60b/0x2b60 drivers/tty/serial/serial_core.c:3353
 serial8250_register_8250_port+0x182b/0x2200 drivers/tty/serial/8250/8250_core.c:877
 serial_pnp_probe+0x579/0x800 drivers/tty/serial/8250/8250_pnp.c:480
 pnp_device_probe+0x30b/0x4c0 drivers/pnp/driver.c:111
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __driver_attach+0x339/0x600 drivers/base/dd.c:1292
 bus_for_each_dev+0x23e/0x2c0 drivers/base/bus.c:383
 bus_add_driver+0x348/0x670 drivers/base/bus.c:763
 driver_register+0x23a/0x320 drivers/base/driver.c:174
 serial8250_init+0x8f/0x160 drivers/tty/serial/8250/8250_platform.c:318
 do_one_initcall+0x250/0x870 init/main.c:1362
 do_initcall_level+0x10a/0x1a0 init/main.c:1424
 do_initcalls+0x59/0xa0 init/main.c:1440
 kernel_init_freeable+0x29d/0x3e0 init/main.c:1675
 kernel_init+0x22/0x1d0 init/main.c:1565
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 13475:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6508 [inline]
 kfree+0x1c5/0x6d0 mm/slub.c:6801
 serial_core_remove_one_port drivers/tty/serial/serial_core.c:3222 [inline]
 serial_core_unregister_port+0x490/0xb40 drivers/tty/serial/serial_core.c:3383
 serial8250_unregister_port+0x26e/0x710 drivers/tty/serial/8250/8250_core.c:932
 pnp_device_remove+0x82/0x260 drivers/pnp/driver.c:133
 device_remove drivers/base/dd.c:616 [inline]
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
 unbind_store+0x1a4/0x1d0 drivers/base/bus.c:244
 kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x61e/0xbb0 fs/read_write.c:687
 ksys_write+0x156/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888025daf300
 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes inside of
 freed 8-byte region [ffff888025daf300, ffff888025daf308)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25daf
flags: 0x80000000000000(node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000000 ffff88813ffbd500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000800080 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 5576757362
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x2591/0x2600 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x230/0x5c0 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab+0x7d/0x620 mm/slub.c:3462
 new_slab mm/slub.c:3513 [inline]
 refill_objects+0x2d8/0x350 mm/slub.c:7417
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x339/0x690 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __do_kmalloc_node mm/slub.c:5413 [inline]
 __kmalloc_node_track_caller_noprof+0x61e/0x7b0 mm/slub.c:5545
 __kmemdup_nul mm/util.c:64 [inline]
 kstrdup+0x42/0x100 mm/util.c:84
 __kernfs_new_node+0xac/0xa70 fs/kernfs/dir.c:661
 kernfs_new_node+0xea/0x140 fs/kernfs/dir.c:751
 kernfs_create_link+0xa7/0x200 fs/kernfs/symlink.c:39
 sysfs_do_create_link_sd+0x83/0x110 fs/sysfs/symlink.c:44
 device_create_sys_dev_entry+0x122/0x190 drivers/base/core.c:3587
 device_add+0x71e/0xb80 drivers/base/core.c:3731
 tty_register_device_attr+0x425/0x990 drivers/tty/tty_io.c:3236
 tty_register_device drivers/tty/tty_io.c:3171 [inline]
 tty_register_driver+0x868/0xe50 drivers/tty/tty_io.c:3449
page last free pid 169 tgid 169 ts 5575398857 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0xf8e/0x1070 mm/page_alloc.c:2962
 __kasan_populate_vmalloc_do mm/kasan/shadow.c:393 [inline]
 __kasan_populate_vmalloc+0x1a8/0x1c0 mm/kasan/shadow.c:424
 kasan_populate_vmalloc include/linux/kasan.h:580 [inline]
 alloc_vmap_area+0xd1a/0x1420 mm/vmalloc.c:2145
 __get_vm_area_node+0x200/0x2f0 mm/vmalloc.c:3248
 __vmalloc_node_range_noprof+0x343/0x1540 mm/vmalloc.c:4064
 __vmalloc_node_noprof+0xc2/0x100 mm/vmalloc.c:4165
 alloc_thread_stack_node kernel/fork.c:359 [inline]
 dup_task_struct+0x2c6/0xa00 kernel/fork.c:930
 copy_process+0x7e0/0x4400 kernel/fork.c:2133
 kernel_clone+0x2d2/0x8d0 kernel/fork.c:2769
 user_mode_thread+0x115/0x180 kernel/fork.c:2846
 call_usermodehelper_exec_work+0x5c/0x230 kernel/umh.c:169
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff888025daf200: 05 fc fc fc 05 fc fc fc 05 fc fc fc 05 fc fc fc
 ffff888025daf280: 05 fc fc fc 05 fc fc fc 05 fc fc fc 05 fc fc fc
>ffff888025daf300: fa fc fc fc 05 fc fc fc fa fc fc fc fa fc fc fc
                   ^
 ffff888025daf380: 05 fc fc fc 00 fc fc fc fa fc fc fc fa fc fc fc
 ffff888025daf400: 05 fc fc fc 04 fc fc fc 00 fc fc fc 00 fc fc fc
==================================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/25 02:29 upstream f49a343b305c 3c3cdf19 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in __setup_irq
2026/09/23 23:12 upstream fe2ec83746e5 0a1606bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Read in __setup_irq
2026/09/23 21:03 upstream fe2ec83746e5 0a1606bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in __setup_irq
2026/09/23 21:03 upstream fe2ec83746e5 0a1606bc .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in __setup_irq
2026/08/11 16:14 upstream f5bbbfec59b4 557a89d3 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in __setup_irq
2026/08/10 15:09 upstream db2ddb871435 558388e4 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Read in __setup_irq
* Struck through repros no longer work on HEAD.