BUG: ADDR [#NUM] SMP

Status: moderation: reported on 2026/10/07 20:13
Subsystems: block
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+e141ea605d78d1a3bb34@syzkaller.appspotmail.com
First crash: 5d00h, last: 5d00h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
a7673380 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ✅ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ BUG: ADDR [#NUM] SMP 2026/10/05 16:18 2026/10/05 16:18 2026/10/05 17:04 1995e6c7

Sample crash report:
 non-slab/vmalloc memory
list_del corruption. next->prev should be ffff0000c8621248, but was ffff80009b7a7aa0. (next=ffff0000c8621248)
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:67!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 4382 Comm: kworker/0:1H Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: kblockd blk_mq_requeue_work
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid_or_report+0x1b4/0x1b8 lib/list_debug.c:65
lr : __list_del_entry_valid_or_report+0x1b4/0x1b8 lib/list_debug.c:65
sp : ffff80009b7a7a40
x29: ffff80009b7a7a40 x28: ffff80009b7a7aa0 x27: 1fffe00018f3f546
x26: ffff0000c79faa30 x25: ffff80009b7a7aa0 x24: dfff800000000000
x23: ffff0000c8621250 x22: dfff800000000000 x21: 1fffe000190c424a
x20: ffff0000c8621248 x19: ffff0000c8621248 x18: 1fffe00035bd4c28
x17: 20747562202c3834 x16: 3231323638633030 x15: 3030666666662065
x14: 000000000000184b x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000001 x9 : b8d9212c5161c700
x8 : b8d9212c5161c700 x7 : ffff800080483190 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008048dc90
x2 : 0000000100000000 x1 : ffff0000c6745880 x0 : 000000000000006d
Call trace:
 __list_del_entry_valid_or_report+0x1b4/0x1b8 lib/list_debug.c:65 (P)
 __list_del_entry_valid include/linux/list.h:140 [inline]
 __list_del_entry include/linux/list.h:261 [inline]
 list_del_init include/linux/list.h:333 [inline]
 blk_mq_requeue_work+0x2b4/0x52c block/blk-mq.c:1552
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Code: 910a8000 aa1303e1 aa1403e3 979c681b (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/03 20:08 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci fe98fb51bf62 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: ADDR [#NUM] SMP
* Struck through repros no longer work on HEAD.