KMSAN: uninit-value in from_kuid_munged (3)

Status: auto-obsoleted due to no activity on 2026/09/24 12:54
Subsystems: kernel
Labels: prio:high
[Documentation on labels]
First crash: 119d, last: 107d
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
e8379621 repro-c 💥 KMSAN: uninit-value in from_kuid_munged (3) 2026/06/10 15:33 2026/06/10 15:33 2026/06/10 17:47 416ea548
c5cc2f92 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KMSAN: uninit-value in from_kuid_munged (3) 2026/06/09 13:13 2026/06/09 13:13 2026/06/09 14:34 c36c07f6
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in from_kuid_munged kernel 7 14 187d 228d 0/29 closed as invalid on 2026/04/01 01:54
upstream KMSAN: uninit-value in from_kuid_munged (2) kernel prio:high 7 22 133d 174d 0/29 closed as invalid on 2026/05/30 06:05

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in map_id_range_up_base kernel/user_namespace.c:360 [inline]
BUG: KMSAN: uninit-value in map_id_range_up kernel/user_namespace.c:391 [inline]
BUG: KMSAN: uninit-value in map_id_up kernel/user_namespace.c:406 [inline]
BUG: KMSAN: uninit-value in from_kuid kernel/user_namespace.c:444 [inline]
BUG: KMSAN: uninit-value in from_kuid_munged+0xb74/0xc90 kernel/user_namespace.c:469
 map_id_range_up_base kernel/user_namespace.c:360 [inline]
 map_id_range_up kernel/user_namespace.c:391 [inline]
 map_id_up kernel/user_namespace.c:406 [inline]
 from_kuid kernel/user_namespace.c:444 [inline]
 from_kuid_munged+0xb74/0xc90 kernel/user_namespace.c:469
 __scm_recv_common+0x233/0x910 net/core/scm.c:517
 scm_recv_unix+0x5e/0x580 net/core/scm.c:545
 __unix_dgram_recvmsg+0x14e1/0x1750 net/unix/af_unix.c:2666
 unix_dgram_recvmsg+0x112/0x180 net/unix/af_unix.c:2686
 sock_recvmsg_nosec net/socket.c:1138 [inline]
 sock_recvmsg+0x27b/0x310 net/socket.c:1160
 ____sys_recvmsg+0x193/0x620 net/socket.c:2919
 ___sys_recvmsg+0x20b/0x850 net/socket.c:2961
 __sys_recvmsg net/socket.c:2994 [inline]
 __do_sys_recvmsg net/socket.c:3000 [inline]
 __se_sys_recvmsg net/socket.c:2997 [inline]
 __x64_sys_recvmsg+0x20e/0x3d0 net/socket.c:2997
 x64_sys_call+0x35cc/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:48
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15d/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable scm created at:
 __unix_dgram_recvmsg+0x4d/0x1750 net/unix/af_unix.c:2569
 unix_dgram_recvmsg+0x112/0x180 net/unix/af_unix.c:2686

CPU: 0 UID: 0 PID: 4936 Comm: udevd Tainted: G             L      syzkaller #0 PREEMPT(lazy) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
=====================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/16 08:46 upstream 2b414a95b8f7 50bb0618 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in from_kuid_munged
2026/06/08 15:11 upstream 4549871118cf 656e94c6 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in from_kuid_munged
2026/06/07 12:44 upstream 979c294509f9 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in from_kuid_munged
2026/06/05 18:39 upstream ddd664bbff63 48b6c3fa .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in from_kuid_munged
2026/06/04 11:16 upstream ba3e43a9e601 197909be .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in from_kuid_munged
2026/06/08 17:16 upstream 2d3090a8aeb5 656e94c6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in from_kuid_munged
* Struck through repros no longer work on HEAD.