last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.148' (ED25519) to the list of known hosts.
[ 69.250986][ T5809] cgroup: Unknown subsys name 'net'
[ 69.416047][ T5809] cgroup: Unknown subsys name 'cpuset'
[ 69.424432][ T5809] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 70.771835][ T5809] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 71.278188][ T1299] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.288313][ T1299] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.804545][ T5825] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 72.812396][ T5825] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 72.821288][ T5826] ==================================================================
[ 72.829359][ T5826] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 72.836809][ T5826] Read of size 2 at addr ffff88805e4afa38 by task kworker/u9:3/5826
[ 72.844768][ T5826]
[ 72.847100][ T5826] CPU: 1 UID: 0 PID: 5826 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full)
[ 72.847115][ T5826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 72.847123][ T5826] Workqueue: hci0 hci_cmd_work
[ 72.847148][ T5826] Call Trace:
[ 72.847154][ T5826]
[ 72.847160][ T5826] dump_stack_lvl+0x189/0x250
[ 72.847179][ T5826] ? __virt_addr_valid+0x1c8/0x5c0
[ 72.847193][ T5826] ? rcu_is_watching+0x15/0xb0
[ 72.847204][ T5826] ? __pfx_dump_stack_lvl+0x10/0x10
[ 72.847221][ T5826] ? rcu_is_watching+0x15/0xb0
[ 72.847231][ T5826] ? lock_release+0x4b/0x3d0
[ 72.847246][ T5826] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 72.847261][ T5826] ? __virt_addr_valid+0x1c8/0x5c0
[ 72.847273][ T5826] ? __virt_addr_valid+0x4a5/0x5c0
[ 72.847287][ T5826] print_report+0xca/0x240
[ 72.847303][ T5826] ? hci_cmd_work+0x5d0/0x7b0
[ 72.847316][ T5826] kasan_report+0x118/0x150
[ 72.847332][ T5826] ? hci_cmd_work+0x5d0/0x7b0
[ 72.847349][ T5826] hci_cmd_work+0x5d0/0x7b0
[ 72.847364][ T5826] ? process_one_work+0x868/0x15e0
[ 72.847379][ T5826] process_one_work+0x93a/0x15e0
[ 72.847393][ T5826] ? __lock_acquire+0xab9/0xd20
[ 72.847414][ T5826] ? __pfx_process_one_work+0x10/0x10
[ 72.847431][ T5826] ? assign_work+0x3a1/0x410
[ 72.847447][ T5826] worker_thread+0x9b0/0xee0
[ 72.847470][ T5826] kthread+0x711/0x8a0
[ 72.847483][ T5826] ? __pfx_worker_thread+0x10/0x10
[ 72.847498][ T5826] ? __pfx_kthread+0x10/0x10
[ 72.847510][ T5826] ? _raw_spin_unlock_irq+0x23/0x50
[ 72.847521][ T5826] ? lockdep_hardirqs_on+0x9c/0x150
[ 72.847535][ T5826] ? __pfx_kthread+0x10/0x10
[ 72.847546][ T5826] ret_from_fork+0x599/0xb30
[ 72.847562][ T5826] ? __pfx_ret_from_fork+0x10/0x10
[ 72.847579][ T5826] ? __switch_to_asm+0x39/0x70
[ 72.847591][ T5826] ? __switch_to_asm+0x33/0x70
[ 72.847602][ T5826] ? __pfx_kthread+0x10/0x10
[ 72.847613][ T5826] ret_from_fork_asm+0x1a/0x30
[ 72.847630][ T5826]
[ 72.847635][ T5826]
[ 73.036361][ T5826] Allocated by task 5146:
[ 73.040674][ T5826] kasan_save_track+0x3e/0x80
[ 73.045337][ T5826] __kasan_slab_alloc+0x6c/0x80
[ 73.050166][ T5826] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 73.056039][ T5826] __alloc_skb+0x112/0x2d0
[ 73.060436][ T5826] hci_cmd_sync_alloc+0x3d/0x3b0
[ 73.065357][ T5826] __hci_cmd_sync_sk+0x1a7/0xc70
[ 73.070280][ T5826] hci_dev_open_sync+0x14b2/0x2dc0
[ 73.075368][ T5826] hci_power_on+0x1b4/0x720
[ 73.079850][ T5826] process_one_work+0x93a/0x15e0
[ 73.084770][ T5826] worker_thread+0x9b0/0xee0
[ 73.089338][ T5826] kthread+0x711/0x8a0
[ 73.093382][ T5826] ret_from_fork+0x599/0xb30
[ 73.097951][ T5826] ret_from_fork_asm+0x1a/0x30
[ 73.102693][ T5826]
[ 73.104992][ T5826] Freed by task 5823:
[ 73.108951][ T5826] kasan_save_track+0x3e/0x80
[ 73.113606][ T5826] kasan_save_free_info+0x46/0x50
[ 73.118608][ T5826] __kasan_slab_free+0x5c/0x80
[ 73.123349][ T5826] kmem_cache_free+0x197/0x640
[ 73.128088][ T5826] vhci_read+0x49a/0x5b0
[ 73.132310][ T5826] vfs_read+0x200/0xa30
[ 73.136440][ T5826] ksys_read+0x145/0x250
[ 73.140659][ T5826] do_syscall_64+0xfa/0xfa0
[ 73.145142][ T5826] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 73.151011][ T5826]
[ 73.153315][ T5826] The buggy address belongs to the object at ffff88805e4afa00
[ 73.153315][ T5826] which belongs to the cache skbuff_head_cache of size 240
[ 73.167864][ T5826] The buggy address is located 56 bytes inside of
[ 73.167864][ T5826] freed 240-byte region [ffff88805e4afa00, ffff88805e4afaf0)
[ 73.181552][ T5826]
[ 73.183855][ T5826] The buggy address belongs to the physical page:
[ 73.190252][ T5826] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e4af
[ 73.198997][ T5826] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 73.206084][ T5826] page_type: f5(slab)
[ 73.210045][ T5826] raw: 00fff00000000000 ffff888140ea2a00 dead000000000122 0000000000000000
[ 73.218603][ T5826] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 73.227162][ T5826] page dumped because: kasan: bad access detected
[ 73.233555][ T5826] page_owner tracks the page as allocated
[ 73.239245][ T5826] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5821, tgid 5821 (udevd), ts 72801832862, free_ts 72799660491
[ 73.257887][ T5826] post_alloc_hook+0x240/0x2a0
[ 73.262630][ T5826] get_page_from_freelist+0x2365/0x2440
[ 73.268154][ T5826] __alloc_frozen_pages_noprof+0x181/0x370
[ 73.273939][ T5826] alloc_pages_mpol+0x232/0x4a0
[ 73.278771][ T5826] allocate_slab+0x86/0x3b0
[ 73.283259][ T5826] ___slab_alloc+0xf56/0x1990
[ 73.287917][ T5826] __slab_alloc+0x65/0x100
[ 73.292311][ T5826] kmem_cache_alloc_noprof+0x40f/0x700
[ 73.297747][ T5826] skb_clone+0x212/0x3a0
[ 73.301969][ T5826] netlink_broadcast_filtered+0x6ae/0x1000
[ 73.307764][ T5826] netlink_sendmsg+0x7ae/0xb30
[ 73.312502][ T5826] __sock_sendmsg+0x21c/0x270
[ 73.317157][ T5826] ____sys_sendmsg+0x505/0x870
[ 73.321896][ T5826] ___sys_sendmsg+0x21f/0x2a0
[ 73.326549][ T5826] __x64_sys_sendmsg+0x19b/0x260
[ 73.331467][ T5826] do_syscall_64+0xfa/0xfa0
[ 73.335951][ T5826] page last free pid 2 tgid 2 stack trace:
[ 73.341732][ T5826] __free_frozen_pages+0xbc8/0xd30
[ 73.346823][ T5826] __kasan_populate_vmalloc+0x1b2/0x1d0
[ 73.352345][ T5826] alloc_vmap_area+0xdca/0x1500
[ 73.357170][ T5826] __get_vm_area_node+0x1f8/0x300
[ 73.362169][ T5826] __vmalloc_node_range_noprof+0x365/0x1640
[ 73.368037][ T5826] __vmalloc_node_noprof+0xc2/0x110
[ 73.373212][ T5826] dup_task_struct+0x3d4/0x830
[ 73.377959][ T5826] copy_process+0x4ea/0x3930
[ 73.382534][ T5826] kernel_clone+0x21e/0x850
[ 73.387017][ T5826] kernel_thread+0x10d/0x160
[ 73.391586][ T5826] kthreadd+0x575/0x770
[ 73.395722][ T5826] ret_from_fork+0x599/0xb30
[ 73.400294][ T5826] ret_from_fork_asm+0x1a/0x30
[ 73.405034][ T5826]
[ 73.407337][ T5826] Memory state around the buggy address:
[ 73.412940][ T5826] ffff88805e4af900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.420983][ T5826] ffff88805e4af980: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 73.429017][ T5826] >ffff88805e4afa00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.437051][ T5826] ^
[ 73.442914][ T5826] ffff88805e4afa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 73.450948][ T5826] ffff88805e4afb00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 73.458984][ T5826] ==================================================================
[ 73.469982][ T5833] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 73.477836][ T5826] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 73.485046][ T5826] CPU: 1 UID: 0 PID: 5826 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full)
[ 73.494499][ T5826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 73.504550][ T5826] Workqueue: hci0 hci_cmd_work
[ 73.509323][ T5826] Call Trace:
[ 73.512603][ T5826]
[ 73.515530][ T5826] dump_stack_lvl+0x99/0x250
[ 73.520125][ T5826] ? __asan_memcpy+0x40/0x70
[ 73.524716][ T5826] ? __pfx_dump_stack_lvl+0x10/0x10
[ 73.529920][ T5826] ? __pfx__printk+0x10/0x10
[ 73.534522][ T5826] vpanic+0x237/0x6d0
[ 73.538507][ T5826] ? __pfx_vpanic+0x10/0x10
[ 73.543009][ T5826] ? preempt_schedule+0xae/0xc0
[ 73.547856][ T5826] ? __pfx_preempt_schedule+0x10/0x10
[ 73.553226][ T5826] panic+0xb9/0xc0
[ 73.556944][ T5826] ? __pfx_panic+0x10/0x10
[ 73.561368][ T5826] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 73.567260][ T5826] ? is_module_address+0x17/0xf0
[ 73.572196][ T5826] ? hci_cmd_work+0x5d0/0x7b0
[ 73.576876][ T5826] check_panic_on_warn+0x89/0xb0
[ 73.581816][ T5826] ? hci_cmd_work+0x5d0/0x7b0
[ 73.586495][ T5826] end_report+0x6f/0x160
[ 73.590739][ T5826] kasan_report+0x129/0x150
[ 73.595248][ T5826] ? hci_cmd_work+0x5d0/0x7b0
[ 73.599931][ T5826] hci_cmd_work+0x5d0/0x7b0
[ 73.604445][ T5826] ? process_one_work+0x868/0x15e0
[ 73.609559][ T5826] process_one_work+0x93a/0x15e0
[ 73.614497][ T5826] ? __lock_acquire+0xab9/0xd20
[ 73.619360][ T5826] ? __pfx_process_one_work+0x10/0x10
[ 73.624740][ T5826] ? assign_work+0x3a1/0x410
[ 73.629334][ T5826] worker_thread+0x9b0/0xee0
[ 73.633937][ T5826] kthread+0x711/0x8a0
[ 73.638017][ T5826] ? __pfx_worker_thread+0x10/0x10
[ 73.643131][ T5826] ? __pfx_kthread+0x10/0x10
[ 73.647718][ T5826] ? _raw_spin_unlock_irq+0x23/0x50
[ 73.652913][ T5826] ? lockdep_hardirqs_on+0x9c/0x150
[ 73.658107][ T5826] ? __pfx_kthread+0x10/0x10
[ 73.662674][ T5826] ret_from_fork+0x599/0xb30
[ 73.667246][ T5826] ? __pfx_ret_from_fork+0x10/0x10
[ 73.672339][ T5826] ? __switch_to_asm+0x39/0x70
[ 73.677081][ T5826] ? __switch_to_asm+0x33/0x70
[ 73.681818][ T5826] ? __pfx_kthread+0x10/0x10
[ 73.686385][ T5826] ret_from_fork_asm+0x1a/0x30
[ 73.691136][ T5826]
[ 73.694472][ T5826] Kernel Offset: disabled
[ 73.698776][ T5826] Rebooting in 86400 seconds..