BUG: unable to handle kernel NULL pointer dereference in __kernel_read

Status: upstream: reported on 2026/10/11 21:38
Reported-by: syzbot+80ef033d168f5e80f36b@syzkaller.appspotmail.com
First crash: 32d, last: 13h50m

Sample crash report:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
  ESR = 0x0000000086000006
  EC = 0x21: IABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010aed4000
[0000000000000000] pgd=0800000136b0d003, p4d=0800000136b0d003, pud=0800000133404003, pmd=0000000000000000
Internal error: Oops: 0000000086000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 7421 Comm: syz.1.667 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 62400805 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=-c)
pc : 0x0
lr : generic_file_read_iter+0x3f0/0x5ac mm/filemap.c:2918
sp : ffff800022d67060
x29: ffff800022d67160 x28: dfff800000000000 x27: ffff7000045ace10
x26: 0000000000000008 x25: ffff0000f79fe780 x24: 1ffff000045ace50
x23: 0000000000020002 x22: ffff80001200e818 x21: 0000000000001000
x20: ffff800022d67220 x19: ffff800022d67270 x18: 1fffe00033c2597e
x17: ffff8000163dd000 x16: ffff800011ba16d0 x15: 0000000000000000
x14: 0000000000000001 x13: 1fffe0001a972c37 x12: 0000000000000000
x11: ff00800008a2c3a4 x10: 0000000000000000 x9 : 739e16c623718900
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800008a2b97c
x2 : 0000000000000000 x1 : ffff800022d67270 x0 : ffff800022d67220
Call trace:
 0x0
 __kernel_read+0x24c/0x5c0 fs/read_write.c:428
 integrity_kernel_read+0x9c/0xe4 security/integrity/iint.c:228
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:485 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:516 [inline]
 ima_calc_file_hash+0x918/0x1560 security/integrity/ima/ima_crypto.c:573
 ima_collect_measurement+0x410/0x950 security/integrity/ima/ima_api.c:293
 ima_update_xattr+0x154/0x49c security/integrity/ima/ima_appraise.c:624
 ima_check_last_writer security/integrity/ima/ima_main.c:175 [inline]
 ima_file_free+0x2b0/0x370 security/integrity/ima/ima_main.c:199
 __fput+0x140/0x7b0 fs/file_table.c:314
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1166
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x9c/0x12c arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:589
Code: bad PC value
---[ end trace 0000000000000000 ]---

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/11/13 03:41 linux-6.1.y c75b0cf0982c c0087d7f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
2026/11/11 17:17 linux-6.1.y c75b0cf0982c e56a968c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
2026/11/11 17:15 linux-6.1.y c75b0cf0982c e56a968c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
2026/11/10 20:21 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
2026/11/10 20:18 linux-6.1.y c75b0cf0982c d3056657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
2026/11/08 11:31 linux-6.1.y c75b0cf0982c 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
2026/11/07 02:03 linux-6.1.y c75b0cf0982c 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
2026/11/06 01:22 linux-6.1.y 08889840163e 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
2026/10/20 18:48 linux-6.1.y 79807e970724 df8746fb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
2026/10/19 05:10 linux-6.1.y 79807e970724 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
2026/10/19 01:18 linux-6.1.y 79807e970724 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
2026/10/11 21:37 linux-6.1.y a500ba24937a 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
* Struck through repros no longer work on HEAD.