general protection fault in ieee802154_llsec_dump

Based on kernel commit 12392d40a3be:

Technical Breakdown

1. Root Cause Analysis

The crash occurs in ieee802154_llsec_dump_table() in net/ieee802154/nl-mac.c:778:

static int
ieee802154_llsec_dump_table(struct sk_buff *skb, struct netlink_callback *cb,
			    int (*step)(struct llsec_dump_data *))
{
	struct net *net = sock_net(skb->sk);
	struct net_device *dev;
	struct llsec_dump_data data;
	int idx = 0;
	int first_dev = cb->args[0];
	int rc;

	for_each_netdev(net, dev) {
		if (idx < first_dev || dev->type != ARPHRD_IEEE802154)
			goto skip;

		data.ops = ieee802154_mlme_ops(dev);
		if (!data.ops->llsec)
			goto skip;

Involved Structs and Fields:
- struct net_device: dev->type and dev->ml_priv.
- ieee802154_mlme_ops(dev) returns dev->ml_priv (defined in include/net/ieee802154_netdev.h:516-520).
- struct ieee802154_mlme_ops: llsec is located at offset 0x38 (56 bytes into the structure after 7 function pointers).
Root Cause Mechanism:
- A userspace process can create a TUN/TAP network device and set its device type to ARPHRD_IEEE802154 via the TUNSETLINK ioctl (__tun_chr_ioctl() in drivers/net/tun.c:3364).
- For a TUN device, dev->ml_priv (and dev->ieee802154_ptr) is initialized to NULL and is never populated with struct ieee802154_mlme_ops.
- When userspace issues a Netlink dump command for IEEE 802.15.4 link-layer security tables (IEEE802154_LLSEC_LIST_KEY, IEEE802154_LLSEC_LIST_DEV, IEEE802154_LLSEC_LIST_DEVKEY, or IEEE802154_LLSEC_LIST_SECLEVEL), the dump handlers invoke ieee802154_llsec_dump_table().
- ieee802154_llsec_dump_table() iterates over all network devices in the namespace using for_each_netdev(net, dev) and checks only if (dev->type != ARPHRD_IEEE802154).
- It assumes that any netdev with dev->type == ARPHRD_IEEE802154 must have a non-NULL dev->ml_priv.
- When it encounters the TUN device with dev->ml_priv == NULL, data.ops is NULL.
- Evaluating if (!data.ops->llsec) immediately dereferences offset 0x38 of NULL ([0x0000000000000038-0x000000000000003f]), triggering an unhandled kernel paging request / general protection fault.

2. Runtime Impact & Classification

MemoryCorruption (false): This is a pure NULL-pointer dereference reading from address 0x38. No invalid memory writes, out-of-bounds writes, or use-after-free conditions occur.
InfoLeak ("none"): Execution halts at the dereference before any data can be returned to userspace; no kernel memory contents or addresses are disclosed.
RawDenialOfService (true): In a production kernel without sanitizers or debug options, dereferencing 0x38 causes an unrecoverable kernel page fault / oops in process context while servicing the Netlink message, causing a denial of service (DoS) or kernel panic.
IsNetCandidate (true): The bug is in the IEEE 802.15.4 networking subsystem (net/ieee802154/) and Netlink interface, triggered by network device iteration (for_each_netdev).
IsKVMCandidate (false): Virtualization and KVM are not involved.

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision
6073f1de	repro-c	Reproduced: ✅	❓	general protection fault in ieee802154_llsec_dump_table (2)	2026/10/29 01:39	2026/10/29 01:39	2026/10/29 02:29	b1d00f76
1535dd12	assessment-security	DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	general protection fault in ieee802154_llsec_dump_table (2)	2026/10/28 00:52	2026/10/28 00:52	2026/10/28 01:50	96923c60

repro-c

Reproduced: ✅

❓

general protection fault in ieee802154_llsec_dump_table (2)

2026/10/29 01:39

2026/10/29 02:29

b1d00f76

1535dd12

assessment-security

DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌

❓

general protection fault in ieee802154_llsec_dump_table (2)

2026/10/28 00:52

2026/10/28 01:50

96923c60

Title	Replies (including bot)	Last reply
[PATCH net] ieee802154: reject ARPHRD_IEEE802154 devices without ieee802154_ptr	1 (1)	2026/10/30 19:25
[syzbot] [wpan?] general protection fault in ieee802154_llsec_dump_table (2)	0 (1)	2026/10/30 12:14

Title

Replies (including bot)

Last reply

[PATCH net] ieee802154: reject ARPHRD_IEEE802154 devices without ieee802154_ptr

1 (1)

2026/10/30 19:25

[syzbot] [wpan?] general protection fault in ieee802154_llsec_dump_table (2)

0 (1)

2026/10/30 12:14

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	general protection fault in ieee802154_llsec_dump_table wpan	2				1	425d	425d	0/29	closed as invalid on 2025/10/12 21:34

Rank 🛈

upstream

general protection fault in ieee802154_llsec_dump_table wpan

425d

0/29

closed as invalid on 2025/10/12 21:34

Created	Duration	User	Patch	Repo	Result
2026/10/29 04:03	20m	retest repro		git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git c339f4010dea8b0d754f84ace70cd1b089878ef8	report job log log

Created

Duration

User

Patch

Repo

Result

2026/10/29 04:03

20m

retest repro

git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git c339f4010dea8b0d754f84ace70cd1b089878ef8

report job log log

Created	Duration	User	Patch	Repo	Result
2026/10/29 07:32	0m	bisect		git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git	error

Created

Duration

User

Patch

Repo

Result

2026/10/29 07:32

bisect

git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

error

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000007: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] CPU: 0 UID: 0 PID: 6025 Comm: syz-executor400 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 RIP: 0010:ieee802154_llsec_dump_table+0x204/0x5d0 net/ieee802154/nl-mac.c:778 Code: 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 d3 02 00 00 4d 8b be b8 07 00 00 49 8d 7f 38 4c 89 bc 24 98 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 18 00 0f 85 a5 02 00 00 4d 8b 7f 38 4d 85 ff 0f 84 b2 01 00 RSP: 0018:ffffc900031ef4a0 EFLAGS: 00010202 RAX: 0000000000000007 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: ffff8880314ccb00 RSI: ffffffff8b9ff162 RDI: 0000000000000038 RBP: 0000000000000026 R08: 0000000000000324 R09: 0000000000000324 R10: ffffc900031ef40f R11: ffffc900031ef520 R12: ffff888036830610 R13: 0000000000000000 R14: ffff88805d7a8000 R15: 0000000000000000 FS: 000055558d27f400(0000) GS:ffff88812248e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff8aa5bff8 CR3: 000000002ce9b000 CR4: 00000000003526f0 Call Trace: <TASK> genl_dumpit+0x125/0x230 net/netlink/genetlink.c:1026 netlink_dump+0x53b/0xd00 net/netlink/af_netlink.c:2351 __netlink_dump_start+0x6d6/0x990 net/netlink/af_netlink.c:2466 genl_family_rcv_msg_dumpit+0x1e2/0x2e0 net/netlink/genetlink.c:1075 genl_family_rcv_msg net/netlink/genetlink.c:1191 [inline] genl_rcv_msg+0x471/0x800 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2576 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0x668/0x950 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x9ac/0x10c0 net/netlink/af_netlink.c:1920 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:818 [inline] __sys_sendto+0x492/0x4e0 net/socket.c:2283 __do_sys_sendto net/socket.c:2290 [inline] __se_sys_sendto net/socket.c:2286 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2286 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0fada8d8b7 Code: 48 89 fa 4c 89 df e8 98 1d 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007fff8aa5c1d0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055558d27f400 RCX: 00007f0fada8d8b7 RDX: 0000000000000014 RSI: 00007fff8aa5c220 RDI: 0000000000000004 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007f0fadac9d23 R13: 00007fff8aa5c390 R14: 000000000000001d R15: 0000000000000002 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:ieee802154_llsec_dump_table+0x204/0x5d0 net/ieee802154/nl-mac.c:778 Code: 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 d3 02 00 00 4d 8b be b8 07 00 00 49 8d 7f 38 4c 89 bc 24 98 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 18 00 0f 85 a5 02 00 00 4d 8b 7f 38 4d 85 ff 0f 84 b2 01 00 RSP: 0018:ffffc900031ef4a0 EFLAGS: 00010202 RAX: 0000000000000007 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: ffff8880314ccb00 RSI: ffffffff8b9ff162 RDI: 0000000000000038 RBP: 0000000000000026 R08: 0000000000000324 R09: 0000000000000324 R10: ffffc900031ef40f R11: ffffc900031ef520 R12: ffff888036830610 R13: 0000000000000000 R14: ffff88805d7a8000 R15: 0000000000000000 FS: 000055558d27f400(0000) GS:ffff88812258e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffdac0fedc4 CR3: 000000002ce9b000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 89 f8 mov %edi,%eax 2: 48 c1 e8 03 shr $0x3,%rax 6: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) a: 0f 85 d3 02 00 00 jne 0x2e3 10: 4d 8b be b8 07 00 00 mov 0x7b8(%r14),%r15 17: 49 8d 7f 38 lea 0x38(%r15),%rdi 1b: 4c 89 bc 24 98 00 00 mov %r15,0x98(%rsp) 22: 00 23: 48 89 f8 mov %rdi,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) <-- trapping instruction 2e: 0f 85 a5 02 00 00 jne 0x2d9 34: 4d 8b 7f 38 mov 0x38(%r15),%r15 38: 4d 85 ff test %r15,%r15 3b: 0f .byte 0xf 3c: 84 .byte 0x84 3d: b2 01 mov $0x1,%dl

Crashes (2):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/10/29 04:23	git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git	c339f4010dea	1d9ca40b	.config	console log	report		C			ci-upstream-kasan-gce-selinux-root	general protection fault in ieee802154_llsec_dump_table
2026/10/26 12:03	upstream	12392d40a3be	1d9ca40b	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-selinux-root	general protection fault in ieee802154_llsec_dump_table

Crashes (2):

Assets (help?)