syzbot


KMSAN: uninit-value in mptcp_established_options

Status: upstream: reported syz repro on 2026/05/01 06:15
Subsystems: mptcp
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com
First crash: 13d, last: 21m
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
5f52de13-b594-4ef7-b867-02a6d887d7bd assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ✅ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KMSAN: uninit-value in mptcp_established_options 2026/05/07 14:10 2026/05/07 14:10 2026/05/07 17:55 06a6ee865c1ddbbe04beddc5a2bf68cc0e8aa03c
Discussions (3)
Title Replies (including bot) Last reply
[PATCH] mptcp: fix KMSAN: uninit-value in mptcp_established_options 11 (15) 2026/05/12 13:22
[PATCH] mptcp: zero opts->ext_copy in mptcp_established_options_dss() 2 (2) 2026/05/04 09:37
[syzbot] [mptcp?] KMSAN: uninit-value in mptcp_established_options 0 (4) 2026/05/03 23:20
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in mptcp_established_options mptcp 19 10 1912d 1911d 0/29 closed as dup on 2021/02/17 18:39
Last patch testing requests (6)
Created Duration User Patch Repo Result
2026/05/12 08:55 1h12m matttbe@kernel.org patch upstream report log
2026/05/04 17:31 36m pabeni@redhat.com patch upstream report log
2026/05/04 16:22 7m pabeni@redhat.com patch upstream error
2026/05/04 10:00 35m matttbe@kernel.org patch upstream report log
2026/05/03 23:20 33m kartikey406@gmail.com patch upstream report log
2026/05/03 14:53 40m kartikey406@gmail.com patch upstream report log

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in mptcp_write_data_fin net/mptcp/options.c:542 [inline]
BUG: KMSAN: uninit-value in mptcp_established_options_dss net/mptcp/options.c:590 [inline]
BUG: KMSAN: uninit-value in mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874
 mptcp_write_data_fin net/mptcp/options.c:542 [inline]
 mptcp_established_options_dss net/mptcp/options.c:590 [inline]
 mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874
 tcp_established_options+0x312/0xcc0 net/ipv4/tcp_output.c:1192
 __tcp_transmit_skb+0x5dc/0x5fe0 net/ipv4/tcp_output.c:1575
 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499
 tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505
 mptcp_subflow_shutdown+0x164/0x690 net/mptcp/protocol.c:3137
 mptcp_check_send_data_fin+0x31b/0x3d0 net/mptcp/protocol.c:3218
 __mptcp_wr_shutdown net/mptcp/protocol.c:3234 [inline]
 __mptcp_close+0x860/0x1360 net/mptcp/protocol.c:3313
 mptcp_close+0x42/0x260 net/mptcp/protocol.c:3367
 inet_release+0x1ee/0x2a0 net/ipv4/af_inet.c:442
 __sock_release net/socket.c:722 [inline]
 sock_close+0xd6/0x2f0 net/socket.c:1514
 __fput+0x60e/0x1010 fs/file_table.c:510
 ____fput+0x25/0x30 fs/file_table.c:538
 task_work_run+0x208/0x2b0 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0x306/0x1ea0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x236/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable opts created at:
 __tcp_transmit_skb+0x4d/0x5fe0 net/ipv4/tcp_output.c:1536
 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499

CPU: 1 UID: 0 PID: 5910 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
=====================================================

Crashes (1335):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/10 12:22 upstream 1bfaee9d3351 29233ece .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/10 12:15 upstream 1bfaee9d3351 29233ece .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 16:50 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 16:49 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 15:30 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 14:33 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 14:14 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 13:20 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/03 13:00 upstream 66edb901bf87 a0d91488 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/14 05:00 upstream e1914add2799 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 20:03 upstream 1d5dcaa3bd65 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 17:24 upstream 1d5dcaa3bd65 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 07:23 upstream c21b90f77687 a0949470 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 06:13 upstream c21b90f77687 a0949470 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 06:13 upstream c21b90f77687 a0949470 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 05:05 upstream c21b90f77687 a0949470 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 02:52 upstream c21b90f77687 a0949470 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 02:25 upstream c21b90f77687 a0949470 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/12 17:44 upstream 50897c955902 d5b1a17d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/12 16:41 upstream 50897c955902 d5b1a17d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/12 16:41 upstream 50897c955902 d5b1a17d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/12 15:00 upstream 50897c955902 d5b1a17d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/12 08:12 upstream 50897c955902 d168f260 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/12 05:58 upstream 50897c955902 d168f260 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/12 05:21 upstream 50897c955902 d168f260 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 19:47 upstream 5d6919055dec e6eb7c0b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 17:08 upstream 5d6919055dec e6eb7c0b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 16:09 upstream 5d6919055dec e6eb7c0b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 14:40 upstream 5d6919055dec e6eb7c0b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 14:33 upstream 5d6919055dec e6eb7c0b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 07:17 upstream aa54b1d27fe0 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 05:33 upstream aa54b1d27fe0 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 05:24 upstream aa54b1d27fe0 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 04:15 upstream aa54b1d27fe0 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 02:54 upstream aa54b1d27fe0 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 02:39 upstream aa54b1d27fe0 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/10 23:54 upstream aa54b1d27fe0 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/10 18:04 upstream 1bfaee9d3351 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/10 17:58 upstream 1bfaee9d3351 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 20:14 upstream 1d5dcaa3bd65 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 18:47 upstream 1d5dcaa3bd65 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 08:54 upstream c21b90f77687 a0949470 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 08:54 upstream c21b90f77687 a0949470 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/13 04:03 upstream c21b90f77687 a0949470 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 18:12 upstream 5d6919055dec e6eb7c0b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 01:32 upstream aa54b1d27fe0 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/11 01:09 upstream aa54b1d27fe0 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/10 16:56 upstream 1bfaee9d3351 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/10 15:44 upstream 1bfaee9d3351 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/10 15:43 upstream 1bfaee9d3351 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/10 14:40 upstream 1bfaee9d3351 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/10 11:29 upstream 1bfaee9d3351 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/01 06:12 upstream 08d0d3466664 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
2026/05/01 00:03 upstream 08d0d3466664 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in mptcp_established_options
* Struck through repros no longer work on HEAD.