BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport (2)

Status: upstream: reported C repro on 2026/09/08 22:08
Subsystems: usb-storage
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+356ae236154297f0d60d@syzkaller.appspotmail.com
Fix commit: usb: storage: ene_ub6250: set transport_reset to avoid NULL deref
Patched on: [ci2-upstream-usb], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce]
First crash: 9d10h, last: 3d04h
Cause bisection: failed (error log, bisect log)
  
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
0f326139 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport (2) 2026/09/09 00:54 2026/09/09 00:54 2026/09/09 01:43 243b72f1
▶ ▼ Discussions (5)
Title Replies (including bot) Last reply
[PATCH v2] usb: storage: ene_ub6250: set transport_reset to avoid NULL deref 2 (2) 2026/09/09 20:56
Re: [PATCH] usb: storage: ene_ub6250: set transport_reset to avoid NULL deref 1 (1) 2026/09/09 17:17
[PATCH] usb: storage: ene_ub6250: set transport_reset to avoid NULL deref 2 (2) 2026/09/09 16:59
Re: [PATCH] usb: storage: ene_ub6250: set transport_reset to avoid NULL deref 1 (1) 2026/09/09 16:59
[syzbot] [usb-storage?] BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport (2) 0 (1) 2026/09/08 22:08
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport usb-storage 10 1 428d 424d 0/29 auto-obsoleted due to no activity on 2025/10/14 16:40

Sample crash report:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 800000006f80d067 P4D 800000006f80d067 PUD 6f9b7067 PMD 0 
Oops: Oops: 0010 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 5647 Comm: usb-storage Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90003c3faf8 EFLAGS: 00010246
RAX: 1ffff1100fe1f9f0 RBX: ffff888072e03110 RCX: ffffffff9a9de501
RDX: 0000000000000001 RSI: ffffffff8e474d50 RDI: ffff88807f0fce90
RBP: ffffc90003c3fcd0 R08: ffffffff907a1e7f R09: 1ffffffff20f43cf
R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff1100fe1f80e
R13: 1ffff92000787f74 R14: ffff88807f0fce90 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff888124cd6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000071e6c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 usb_stor_invoke_transport+0x55a/0x1a40 drivers/usb/storage/transport.c:926
 usb_stor_control_thread+0x44c/0x8f0 drivers/usb/storage/usb.c:462
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 0018:ffffc90003c3faf8 EFLAGS: 00010246
RAX: 1ffff1100fe1f9f0 RBX: ffff888072e03110 RCX: ffffffff9a9de501
RDX: 0000000000000001 RSI: ffffffff8e474d50 RDI: ffff88807f0fce90
RBP: ffffc90003c3fcd0 R08: ffffffff907a1e7f R09: 1ffffffff20f43cf
R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff1100fe1f80e
R13: 1ffff92000787f74 R14: ffff88807f0fce90 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff888124cd6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 0000000071e6c000 CR4: 00000000003526f0

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/08 22:55 upstream 28924df2a08f 243b72f1 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
2026/09/08 21:18 upstream 28924df2a08f 243b72f1 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
2026/09/08 19:37 upstream 28924df2a08f 243b72f1 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
2026/09/08 17:56 upstream 28924df2a08f 243b72f1 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
2026/09/08 16:12 upstream 28924df2a08f 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
2026/09/14 22:43 linux-next 9d80aa4617b3 924033e8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
2026/09/10 18:25 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 8d70a378e702 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
2026/09/09 15:11 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 34c9c5517033 8387c273 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-usb BUG: unable to handle kernel NULL pointer dereference in usb_stor_invoke_transport
* Struck through repros no longer work on HEAD.