BUG: MAX_LOCK_DEPTH too low!

Status: upstream: reported on 2026/08/04 13:33
Reported-by: syzbot+bfef5b52fa56c140a335@syzkaller.appspotmail.com
First crash: 1d06h, last: 34m
Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: MAX_LOCK_DEPTH too low! net -1 1 3018d 3018d 5/29 fixed on 2018/05/17 10:02
upstream BUG: MAX_LOCK_DEPTH too low! (6) net prio:normal -1 1 144d 144d 29/29 fixed on 2026/05/21 08:48
linux-6.6 BUG: MAX_LOCK_DEPTH too low! origin:lts-only -1 syz, C done 5 253d 305d 0/2 upstream: reported C repro on 2025/10/04 16:06
upstream BUG: MAX_LOCK_DEPTH too low! (3) smc -1 syz, C done 18 1629d 1638d 22/29 fixed on 2023/02/24 13:50
upstream BUG: MAX_LOCK_DEPTH too low! (5) btrfs -1 syz, C 12 293d 633d 0/29 auto-obsoleted due to no activity on 2026/01/24 05:53
upstream BUG: MAX_LOCK_DEPTH too low! (2) net -1 syz, C done 5 2945d 2976d 13/29 fixed on 2019/11/11 16:48
upstream BUG: MAX_LOCK_DEPTH too low! (4) fs -1 syz, C error 1364 723d 819d 27/29 fixed on 2024/08/25 15:26

Sample crash report:
BUG: MAX_LOCK_DEPTH too low!
turning off the locking correctness validator.
depth: 48  max: 48!
48 locks held by kworker/u4:0/9:
 #0: ffff888062652138 ((wq_completion)wg-kex-wg2#5){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc90000ce7d00 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: ffff888021458ad8 (&peer->endpoint_lock){++-.}-{2:2}, at: wg_socket_send_skb_to_peer+0x50/0x1c0 drivers/net/wireguard/socket.c:173
 #3: ffffffff8c31efc0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
 #4: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #5: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #6: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #7: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #8: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #9: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #10: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #11: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #12: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #13: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #14: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #15: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #16: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #17: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #18: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #19: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #20: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #21: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #22: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #23: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #24: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #25: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #26: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #27: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #28: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #29: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #30: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #31: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #32: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #33: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #34: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #35: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #36: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #37: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #38: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #39: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #40: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #41: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #42: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #43: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #44: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #45: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #46: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #47: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 include/linux/rcupdate.h:313
INFO: lockdep is turned off.
CPU: 1 PID: 9 Comm: kworker/u4:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: wg-kex-wg2 wg_packet_handshake_send_worker
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 __lock_acquire+0x1247/0x7b50 kernel/locking/lockdep.c:-1
 lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623
 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:313
 rcu_read_lock include/linux/rcupdate.h:740 [inline]
 ip6_dst_check+0xe2/0x7a0 net/ipv6/route.c:2744
 dst_cache_per_cpu_get+0x1a3/0x310 net/core/dst_cache.c:51
 rpl_output+0x165/0x730 net/ipv6/rpl_iptunnel.c:214
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x31f/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 ip6tunnel_xmit include/net/ip6_tunnel.h:160 [inline]
 udp_tunnel6_xmit_skb+0x4b7/0x8b0 net/ipv6/ip6_udp_tunnel.c:110
 send6+0x5a0/0x8d0 drivers/net/wireguard/socket.c:152
 wg_socket_send_skb_to_peer+0x10d/0x1c0 drivers/net/wireguard/socket.c:178
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
 wg_packet_handshake_send_worker+0x203/0x360 drivers/net/wireguard/send.c:51
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/05 19:16 linux-5.15.y 6e2fd6534337 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: MAX_LOCK_DEPTH too low!
2026/08/05 19:09 linux-5.15.y 6e2fd6534337 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: MAX_LOCK_DEPTH too low!
2026/08/05 19:08 linux-5.15.y 6e2fd6534337 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: MAX_LOCK_DEPTH too low!
2026/08/05 19:06 linux-5.15.y 6e2fd6534337 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: MAX_LOCK_DEPTH too low!
2026/08/05 03:06 linux-5.15.y 6e2fd6534337 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: MAX_LOCK_DEPTH too low!
2026/08/04 13:33 linux-5.15.y 6e2fd6534337 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: MAX_LOCK_DEPTH too low!
2026/08/04 13:32 linux-5.15.y 6e2fd6534337 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: MAX_LOCK_DEPTH too low!
* Struck through repros no longer work on HEAD.