KASAN: use-after-free Write in rcu_segcblist_enqueue

Status: upstream: reported C repro on 2026/06/22 22:11
Reported-by: syzbot+c103c1bbd97dad306fc9@syzkaller.appspotmail.com
First crash: 114d, last: 20h22m
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-6-1 KASAN: use-after-free Write in rcu_segcblist_enqueue 22 syz, C 288 23h07m 121d 0/2 upstream: reported C repro on 2026/06/14 23:49
android-5-15 KASAN: use-after-free Write in rcu_segcblist_enqueue origin:upstream missing-backport 22 syz, C 97 9h00m 107d 0/2 upstream: reported C repro on 2026/06/29 08:43
upstream general protection fault in rcu_segcblist_enqueue kvm-x86 2 syz, C done done 368 1864d 1928d 20/29 fixed on 2022/03/08 16:11

Sample crash report:
IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
==================================================================
BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x85/0xa0 kernel/rcu/rcu_segcblist.c:250
Write of size 8 at addr ffff88810f595990 by task kworker/u4:3/351

CPU: 1 PID: 351 Comm: kworker/u4:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: l2tp l2tp_tunnel_del_work
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 __asan_report_store8_noabort+0x17/0x20 mm/kasan/report_generic.c:314
 rcu_segcblist_enqueue+0x85/0xa0 kernel/rcu/rcu_segcblist.c:250
 __call_rcu kernel/rcu/tree.c:2998 [inline]
 call_rcu+0x4df/0x1090 kernel/rcu/tree.c:3054
 radix_tree_node_free lib/radix-tree.c:308 [inline]
 delete_node+0x1c0/0xa60 lib/radix-tree.c:571
 __radix_tree_delete+0x258/0x3c0 lib/radix-tree.c:1376
 radix_tree_delete_item+0x257/0x360 lib/radix-tree.c:1427
 idr_remove+0x43/0x60 lib/idr.c:156
 l2tp_tunnel_remove net/l2tp/l2tp_core.c:1263 [inline]
 l2tp_tunnel_del_work+0x34f/0x3d0 net/l2tp/l2tp_core.c:1287
 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
 kthread+0x324/0x3b0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

Allocated by task 4021:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 351:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_del

Crashes (270):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/12 05:13 android13-5.10-lts b677692288f7 4f92358f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/07 13:52 android13-5.10-lts b677692288f7 6520ecdb .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/07/21 13:10 android13-5.10-lts 50b3a256e550 7c5de9c3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/06/22 22:00 android13-5.10-lts 72aefab72b3d 5a630be6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/06/26 08:48 android13-5.10-lts 79e905dd56a7 7ff32d8b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/13 23:17 android13-5.10-lts 390db4f54a67 7321cd29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/13 22:08 android13-5.10-lts 390db4f54a67 7321cd29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/13 20:27 android13-5.10-lts 390db4f54a67 5a1eeac4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/12 17:08 android13-5.10-lts 437aef3f57e8 745a967f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/12 01:53 android13-5.10-lts b677692288f7 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/11 05:29 android13-5.10-lts b677692288f7 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/09 19:00 android13-5.10-lts b677692288f7 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/08 11:27 android13-5.10-lts b677692288f7 4f6a9fcf .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/08 02:06 android13-5.10-lts b677692288f7 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/07 21:17 android13-5.10-lts b677692288f7 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/04 04:02 android13-5.10-lts 8ddf8d57c49c 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/04 02:53 android13-5.10-lts 8ddf8d57c49c 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/04 00:49 android13-5.10-lts 8ddf8d57c49c 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/03 03:53 android13-5.10-lts df334e630ed3 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/02 16:39 android13-5.10-lts df334e630ed3 6d32eb1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/02 04:46 android13-5.10-lts 27ea5541934c 6d32eb1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/02 01:10 android13-5.10-lts 27ea5541934c f5cdae2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/01 10:17 android13-5.10-lts 27ea5541934c 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/01 04:50 android13-5.10-lts 27ea5541934c 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/10/01 02:20 android13-5.10-lts 27ea5541934c 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/30 18:33 android13-5.10-lts 27ea5541934c 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/30 17:10 android13-5.10-lts 27ea5541934c 7808aef4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/30 16:06 android13-5.10-lts 27ea5541934c 7808aef4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/28 13:53 android13-5.10-lts c5d8ec7afea2 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/28 12:04 android13-5.10-lts c5d8ec7afea2 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/28 06:23 android13-5.10-lts c5d8ec7afea2 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/28 00:50 android13-5.10-lts c5d8ec7afea2 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/27 21:21 android13-5.10-lts c5d8ec7afea2 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/27 09:20 android13-5.10-lts c5d8ec7afea2 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/27 03:17 android13-5.10-lts c5d8ec7afea2 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/26 19:09 android13-5.10-lts c5d8ec7afea2 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/25 00:38 android13-5.10-lts 452567d1985b 3c3cdf19 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/24 06:17 android13-5.10-lts 452567d1985b 0281b448 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/24 03:45 android13-5.10-lts 452567d1985b 0281b448 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/22 23:25 android13-5.10-lts 452567d1985b 5207b90e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/22 01:59 android13-5.10-lts 452567d1985b 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/22 00:44 android13-5.10-lts 452567d1985b 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/21 20:15 android13-5.10-lts 452567d1985b 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/21 07:16 android13-5.10-lts 452567d1985b 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/21 00:57 android13-5.10-lts 452567d1985b 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/20 19:28 android13-5.10-lts 452567d1985b 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/20 08:01 android13-5.10-lts 452567d1985b 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/19 10:39 android13-5.10-lts 452567d1985b 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/19 04:07 android13-5.10-lts 452567d1985b 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/18 20:22 android13-5.10-lts 452567d1985b 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/18 17:41 android13-5.10-lts 452567d1985b 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/17 05:55 android13-5.10-lts 452567d1985b 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/09/17 02:54 android13-5.10-lts 452567d1985b 95928915 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
2026/06/22 18:49 android13-5.10-lts 72aefab72b3d 5a630be6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 KASAN: use-after-free Write in rcu_segcblist_enqueue
* Struck through repros no longer work on HEAD.