Internal error in __switch_to (2)

Status: moderation: reported on 2026/10/21 13:58
Subsystems: arm
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+d8334bd35d99cb0abce4@syzkaller.appspotmail.com
First crash: 4d04h, last: 4d04h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
e2667f0d repro-c 💥 Internal error in __switch_to (2) 2026/10/20 23:14 2026/10/20 23:14 2026/10/21 13:35 61c200c7
a6291056 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ Internal error in __switch_to (2) 2026/10/19 01:16 2026/10/19 01:16 2026/10/19 01:35 432c0077
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream Internal error in __switch_to arm 2 2 873d 869d 0/29 auto-obsoleted due to no activity on 2024/08/29 02:57
linux-6.1 KASAN: slab-out-of-bounds Read in __switch_to 17 1 477d 477d 0/3 auto-obsoleted due to no activity on 2025/10/09 02:03

Sample crash report:
Internal error: Oops - FPAC: 0000000072000000 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 6465 Comm: syz.1.358 Tainted: G   M                syzkaller #0 PREEMPT 
Tainted: [M]=MACHINE_CHECK
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
pstate: 234000c5 (nzCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __switch_to+0x2c8/0x6e4 arch/arm64/kernel/process.c:777
lr : 0x0
sp : ffff80009a226fe0
x29: 0000000000000000 x28: 0000000080000000 x27: 1fffe000183450b0
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000
x20: 0000000000000000 x19: 0000000000000000 x18: 1fffe000349f7028
x17: 0000000000000003 x16: ffff800089797000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000
x11: 00000000000000c0 x10: a0409a11cad66ceb x9 : 81d29e7300c921ed
x8 : ffff0000c5e0b988 x7 : ffff800080542460 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008688ada8
x2 : 00000000c8002000 x1 : ffff0000c5e09d80 x0 : ffff0000ceed3b00
Call trace:
 __switch_to+0x2c8/0x6e4 arch/arm64/kernel/process.c:777 (P)
Code: a94357f6 a9425ff8 a94167fa a8c57bfd (d50323bf) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	a94357f6 	ldp	x22, x21, [sp, #48]
   4:	a9425ff8 	ldp	x24, x23, [sp, #32]
   8:	a94167fa 	ldp	x26, x25, [sp, #16]
   c:	a8c57bfd 	ldp	x29, x30, [sp], #80
* 10:	d50323bf 	autiasp <-- trapping instruction

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/17 13:52 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 Internal error in __switch_to
* Struck through repros no longer work on HEAD.