KMSAN: uninit-value in __skb_flow_dissect (5)

Status: closed as invalid on 2026/09/11 15:46
Subsystems: net
Labels: prio:normal
[Documentation on labels]
First crash: 166d, last: 92d
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
d6c89979 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KMSAN: uninit-value in __skb_flow_dissect (5) 2026/06/01 08:20 2026/06/01 08:20 2026/06/01 09:23 6b4a8443
a501c54e assessment-security 💥 KMSAN: uninit-value in __skb_flow_dissect (5) 2026/05/15 10:45 2026/05/15 10:45 2026/05/15 10:46 9cd3beaa
▶ ▼ Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in __skb_flow_dissect (3) net 7 syz, C 3 2248d 2246d 0/29 closed as invalid on 2020/07/22 16:31
upstream KMSAN: uninit-value in __skb_flow_dissect net 7 syz, C 15 3069d 3083d 0/29 closed as invalid on 2018/06/27 15:08
upstream KMSAN: uninit-value in __skb_flow_dissect (4) net 7 3 336d 336d 0/29 closed as invalid on 2026/01/09 12:02
upstream KMSAN: uninit-value in __skb_flow_dissect (2) net 7 7 2379d 2498d 0/29 auto-closed as invalid on 2020/07/08 18:36
upstream KASAN: use-after-free Read in __skb_flow_dissect (2) net 19 syz, C done unreliable 6 1324d 1502d 0/29 closed as invalid on 2023/03/21 17:25
upstream Internal error in __skb_flow_dissect net 2 1 1225d 1221d 0/29 auto-obsoleted due to no activity on 2023/08/07 05:35
upstream KASAN: use-after-free Read in __skb_flow_dissect net 19 3 1959d 2057d 0/29 auto-closed as invalid on 2021/08/03 02:14
upstream KASAN: use-after-free Read in __skb_flow_dissect (3) net 19 syz, C 1 977d 987d 25/29 fixed on 2024/03/26 00:54
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2026/09/09 05:58 24m retest repro upstream error job log
2026/06/30 22:49 34m retest repro upstream error
2026/04/17 20:55 29m retest repro upstream error

Sample crash report:
TC_ACT_REPEAT abuse ?
=====================================================
BUG: KMSAN: uninit-value in __skb_flow_dissect+0x2022/0xa1f0 net/core/flow_dissector.c:1198
 __skb_flow_dissect+0x2022/0xa1f0 net/core/flow_dissector.c:1198
 skb_flow_dissect_flow_keys include/linux/skbuff.h:1612 [inline]
 cake_hash net/sched/sch_cake.c:724 [inline]
 cake_classify net/sched/sch_cake.c:1747 [inline]
 cake_enqueue+0x1149/0xf750 net/sched/sch_cake.c:1765
 dev_qdisc_enqueue net/core/dev.c:4168 [inline]
 __dev_xmit_skb net/core/dev.c:4283 [inline]
 __dev_queue_xmit+0x25ad/0x5980 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3076 [inline]
 packet_sendmsg+0x91d9/0xa320 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xf37/0xfd0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

<Zero or more stacks not recorded to save memory>

Uninit was stored to memory at:
 skb_data_move+0x3b4/0x4f0 include/linux/skbuff.h:-1
 skb_postpush_data_move include/linux/skbuff.h:4652 [inline]
 __vlan_insert_inner_tag include/linux/if_vlan.h:368 [inline]
 __vlan_insert_tag include/linux/if_vlan.h:407 [inline]
 skb_vlan_push+0x647/0xb70 net/core/skbuff.c:6475
 tcf_vlan_act+0xc09/0x12c0 net/sched/act_vlan.c:49
 tc_act include/net/tc_wrapper.h:130 [inline]
 tcf_action_exec+0x21f/0x1190 net/sched/act_api.c:1152
 tcf_exts_exec include/net/pkt_cls.h:349 [inline]
 mall_classify+0x183/0x290 net/sched/cls_matchall.c:42
 tc_classify include/net/tc_wrapper.h:197 [inline]
 __tcf_classify net/sched/cls_api.c:1764 [inline]
 tcf_classify+0x855/0x1ca0 net/sched/cls_api.c:1860
 cake_classify net/sched/sch_cake.c:1726 [inline]
 cake_enqueue+0x16b/0xf750 net/sched/sch_cake.c:1765
 dev_qdisc_enqueue net/core/dev.c:4168 [inline]
 __dev_xmit_skb net/core/dev.c:4283 [inline]
 __dev_queue_xmit+0x25ad/0x5980 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3076 [inline]
 packet_sendmsg+0x91d9/0xa320 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xf37/0xfd0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 skb_data_move+0x3b4/0x4f0 include/linux/skbuff.h:-1
 skb_postpush_data_move include/linux/skbuff.h:4652 [inline]
 __vlan_insert_inner_tag include/linux/if_vlan.h:368 [inline]
 __vlan_insert_tag include/linux/if_vlan.h:407 [inline]
 skb_vlan_push+0x647/0xb70 net/core/skbuff.c:6475
 tcf_vlan_act+0xc09/0x12c0 net/sched/act_vlan.c:49
 tc_act include/net/tc_wrapper.h:130 [inline]
 tcf_action_exec+0x21f/0x1190 net/sched/act_api.c:1152
 tcf_exts_exec include/net/pkt_cls.h:349 [inline]
 mall_classify+0x183/0x290 net/sched/cls_matchall.c:42
 tc_classify include/net/tc_wrapper.h:197 [inline]
 __tcf_classify net/sched/cls_api.c:1764 [inline]
 tcf_classify+0x855/0x1ca0 net/sched/cls_api.c:1860
 cake_classify net/sched/sch_cake.c:1726 [inline]
 cake_enqueue+0x16b/0xf750 net/sched/sch_cake.c:1765
 dev_qdisc_enqueue net/core/dev.c:4168 [inline]
 __dev_xmit_skb net/core/dev.c:4283 [inline]
 __dev_queue_xmit+0x25ad/0x5980 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3076 [inline]
 packet_sendmsg+0x91d9/0xa320 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xf37/0xfd0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 pskb_expand_head+0x4a0/0x1fb0 net/core/skbuff.c:2323
 __skb_cow include/linux/skbuff.h:3854 [inline]
 skb_cow_head include/linux/skbuff.h:3888 [inline]
 __vlan_insert_inner_tag include/linux/if_vlan.h:361 [inline]
 __vlan_insert_tag include/linux/if_vlan.h:407 [inline]
 skb_vlan_push+0x444/0xb70 net/core/skbuff.c:6475
 tcf_vlan_act+0xc09/0x12c0 net/sched/act_vlan.c:49
 tc_act include/net/tc_wrapper.h:130 [inline]
 tcf_action_exec+0x21f/0x1190 net/sched/act_api.c:1152
 tcf_exts_exec include/net/pkt_cls.h:349 [inline]
 mall_classify+0x183/0x290 net/sched/cls_matchall.c:42
 tc_classify include/net/tc_wrapper.h:197 [inline]
 __tcf_classify net/sched/cls_api.c:1764 [inline]
 tcf_classify+0x855/0x1ca0 net/sched/cls_api.c:1860
 cake_classify net/sched/sch_cake.c:1726 [inline]
 cake_enqueue+0x16b/0xf750 net/sched/sch_cake.c:1765
 dev_qdisc_enqueue net/core/dev.c:4168 [inline]
 __dev_xmit_skb net/core/dev.c:4283 [inline]
 __dev_queue_xmit+0x25ad/0x5980 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3076 [inline]
 packet_sendmsg+0x91d9/0xa320 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xf37/0xfd0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 skb_data_move+0x3b4/0x4f0 include/linux/skbuff.h:-1
 skb_postpush_data_move include/linux/skbuff.h:4652 [inline]
 __vlan_insert_inner_tag include/linux/if_vlan.h:368 [inline]
 __vlan_insert_tag include/linux/if_vlan.h:407 [inline]
 skb_vlan_push+0x647/0xb70 net/core/skbuff.c:6475
 tcf_vlan_act+0xc09/0x12c0 net/sched/act_vlan.c:49
 tc_act include/net/tc_wrapper.h:130 [inline]
 tcf_action_exec+0x21f/0x1190 net/sched/act_api.c:1152
 tcf_exts_exec include/net/pkt_cls.h:349 [inline]
 mall_classify+0x183/0x290 net/sched/cls_matchall.c:42
 tc_classify include/net/tc_wrapper.h:197 [inline]
 __tcf_classify net/sched/cls_api.c:1764 [inline]
 tcf_classify+0x855/0x1ca0 net/sched/cls_api.c:1860
 cake_classify net/sched/sch_cake.c:1726 [inline]
 cake_enqueue+0x16b/0xf750 net/sched/sch_cake.c:1765
 dev_qdisc_enqueue net/core/dev.c:4168 [inline]
 __dev_xmit_skb net/core/dev.c:4283 [inline]
 __dev_queue_xmit+0x25ad/0x5980 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3076 [inline]
 packet_sendmsg+0x91d9/0xa320 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xf37/0xfd0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 skb_data_move+0x3b4/0x4f0 include/linux/skbuff.h:-1
 skb_postpush_data_move include/linux/skbuff.h:4652 [inline]
 __vlan_insert_inner_tag include/linux/if_vlan.h:368 [inline]
 __vlan_insert_tag include/linux/if_vlan.h:407 [inline]
 skb_vlan_push+0x647/0xb70 net/core/skbuff.c:6475
 tcf_vlan_act+0xc09/0x12c0 net/sched/act_vlan.c:49
 tc_act include/net/tc_wrapper.h:130 [inline]
 tcf_action_exec+0x21f/0x1190 net/sched/act_api.c:1152
 tcf_exts_exec include/net/pkt_cls.h:349 [inline]
 mall_classify+0x183/0x290 net/sched/cls_matchall.c:42
 tc_classify include/net/tc_wrapper.h:197 [inline]
 __tcf_classify net/sched/cls_api.c:1764 [inline]
 tcf_classify+0x855/0x1ca0 net/sched/cls_api.c:1860
 cake_classify net/sched/sch_cake.c:1726 [inline]
 cake_enqueue+0x16b/0xf750 net/sched/sch_cake.c:1765
 dev_qdisc_enqueue net/core/dev.c:4168 [inline]
 __dev_xmit_skb net/core/dev.c:4283 [inline]
 __dev_queue_xmit+0x25ad/0x5980 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3076 [inline]
 packet_sendmsg+0x91d9/0xa320 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xf37/0xfd0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 skb_data_move+0x3b4/0x4f0 include/linux/skbuff.h:-1
 skb_postpush_data_move include/linux/skbuff.h:4652 [inline]
 __vlan_insert_inner_tag include/linux/if_vlan.h:368 [inline]
 __vlan_insert_tag include/linux/if_vlan.h:407 [inline]
 skb_vlan_push+0x647/0xb70 net/core/skbuff.c:6475
 tcf_vlan_act+0xc09/0x12c0 net/sched/act_vlan.c:49
 tc_act include/net/tc_wrapper.h:130 [inline]
 tcf_action_exec+0x21f/0x1190 net/sched/act_api.c:1152
 tcf_exts_exec include/net/pkt_cls.h:349 [inline]
 mall_classify+0x183/0x290 net/sched/cls_matchall.c:42
 tc_classify include/net/tc_wrapper.h:197 [inline]
 __tcf_classify net/sched/cls_api.c:1764 [inline]
 tcf_classify+0x855/0x1ca0 net/sched/cls_api.c:1860
 cake_classify net/sched/sch_cake.c:1726 [inline]
 cake_enqueue+0x16b/0xf750 net/sched/sch_cake.c:1765
 dev_qdisc_enqueue net/core/dev.c:4168 [inline]
 __dev_xmit_skb net/core/dev.c:4283 [inline]
 __dev_queue_xmit+0x25ad/0x5980 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3076 [inline]
 packet_sendmsg+0x91d9/0xa320 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xf37/0xfd0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 skb_data_move+0x3b4/0x4f0 include/linux/skbuff.h:-1
 skb_postpush_data_move include/linux/skbuff.h:4652 [inline]
 __vlan_insert_inner_tag include/linux/if_vlan.h:368 [inline]
 __vlan_insert_tag include/linux/if_vlan.h:407 [inline]
 skb_vlan_push+0x647/0xb70 net/core/skbuff.c:6475
 tcf_vlan_act+0xc09/0x12c0 net/sched/act_vlan.c:49
 tc_act include/net/tc_wrapper.h:130 [inline]
 tcf_action_exec+0x21f/0x1190 net/sched/act_api.c:1152
 tcf_exts_exec include/net/pkt_cls.h:349 [inline]
 mall_classify+0x183/0x290 net/sched/cls_matchall.c:42
 tc_classify include/net/tc_wrapper.h:197 [inline]
 __tcf_classify net/sched/cls_api.c:1764 [inline]
 tcf_classify+0x855/0x1ca0 net/sched/cls_api.c:1860
 cake_classify net/sched/sch_cake.c:1726 [inline]
 cake_enqueue+0x16b/0xf750 net/sched/sch_cake.c:1765
 dev_qdisc_enqueue net/core/dev.c:4168 [inline]
 __dev_xmit_skb net/core/dev.c:4283 [inline]
 __dev_queue_xmit+0x25ad/0x5980 net/core/dev.c:4819
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 packet_xmit+0x8f/0x710 net/packet/af_packet.c:275
 packet_snd net/packet/af_packet.c:3076 [inline]
 packet_sendmsg+0x91d9/0xa320 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xf37/0xfd0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4545 [inline]
 slab_alloc_node mm/slub.c:4866 [inline]
 kmem_cache_alloc_node_noprof+0x3cd/0x12d0 mm/slub.c:4918
 kmalloc_reserve net/core/skbuff.c:613 [inline]
 __alloc_skb+0x855/0x1190 net/core/skbuff.c:713
 alloc_skb include/linux/skbuff.h:1383 [inline]
 alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6763
 sock_alloc_send_pskb+0xacb/0xc60 net/core/sock.c:2995
 packet_alloc_skb net/packet/af_packet.c:2926 [inline]
 packet_snd net/packet/af_packet.c:3019 [inline]
 packet_sendmsg+0x7477/0xa320 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xf37/0xfd0 net/socket.c:2592
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2681
 x64_sys_call+0x1e20/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 6044 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
=====================================================

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/03 19:25 upstream d8a9a4b11a13 4440e7c2 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __skb_flow_dissect
2026/06/14 13:51 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __skb_flow_dissect
2026/06/14 03:02 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __skb_flow_dissect
2026/06/14 03:02 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __skb_flow_dissect
2026/06/14 03:01 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __skb_flow_dissect
2026/06/03 21:53 upstream ba3e43a9e601 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __skb_flow_dissect
2026/04/02 09:33 upstream 9147566d8016 0cb124d5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __skb_flow_dissect
2026/04/02 09:23 upstream 9147566d8016 0cb124d5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __skb_flow_dissect
2026/06/14 19:46 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __skb_flow_dissect
2026/06/14 03:34 upstream 2b414a95b8f7 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __skb_flow_dissect
2026/05/31 20:43 upstream 174914ea5513 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __skb_flow_dissect
2026/05/30 11:41 upstream 9215e74f228f 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __skb_flow_dissect
2026/05/21 10:33 upstream df685633c3db 41b8c833 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __skb_flow_dissect
2026/05/21 10:31 upstream df685633c3db 41b8c833 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __skb_flow_dissect
2026/05/11 03:08 upstream aa54b1d27fe0 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __skb_flow_dissect
2026/05/11 03:04 upstream aa54b1d27fe0 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __skb_flow_dissect
2026/04/02 12:50 upstream 9147566d8016 0cb124d5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __skb_flow_dissect
* Struck through repros no longer work on HEAD.