syzkaller syzkaller login: [ 15.337387][ T28] kauditd_printk_skb: 48 callbacks suppressed [ 15.337401][ T28] audit: type=1400 audit(1784524704.655:59): avc: denied { transition } for pid=239 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.341512][ T28] audit: type=1400 audit(1784524704.655:60): avc: denied { noatsecure } for pid=239 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.344127][ T28] audit: type=1400 audit(1784524704.655:61): avc: denied { write } for pid=239 comm="sh" path="pipe:[14817]" dev="pipefs" ino=14817 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 15.347105][ T28] audit: type=1400 audit(1784524704.655:62): avc: denied { rlimitinh } for pid=239 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.349755][ T28] audit: type=1400 audit(1784524704.655:63): avc: denied { siginh } for pid=239 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.149' (ED25519) to the list of known hosts. 2026/07/20 05:18:33 parsed 1 programs 2026/07/20 05:18:33 serving rpc on tcp://36701 [ 24.434307][ T28] audit: type=1400 audit(1784524713.755:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.455166][ T28] audit: type=1400 audit(1784524713.755:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.196776][ T28] audit: type=1400 audit(1784524714.515:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.197810][ T301] cgroup: Unknown subsys name 'net' [ 25.219535][ T28] audit: type=1400 audit(1784524714.515:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.246975][ T28] audit: type=1400 audit(1784524714.555:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.247130][ T301] cgroup: Unknown subsys name 'devices' [ 25.362548][ T301] cgroup: Unknown subsys name 'hugetlb' [ 25.368141][ T301] cgroup: Unknown subsys name 'rlimit' [ 25.475398][ T28] audit: type=1400 audit(1784524714.795:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.498587][ T28] audit: type=1400 audit(1784524714.795:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.503601][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.519158][ T28] audit: type=1400 audit(1784524714.795:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.541519][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.547968][ T28] audit: type=1400 audit(1784524714.795:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.576662][ T28] audit: type=1400 audit(1784524714.795:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.260211][ T308] request_module fs-gadgetfs succeeded, but still no fs? [ 26.559069][ T336] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.566295][ T336] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.573772][ T336] device bridge_slave_0 entered promiscuous mode [ 26.581644][ T336] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.588692][ T336] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.596055][ T336] device bridge_slave_1 entered promiscuous mode [ 26.602823][ T332] syz-executor (332) used greatest stack depth: 22176 bytes left [ 26.636222][ T336] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.643711][ T336] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.650997][ T336] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.658014][ T336] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.674951][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.682841][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.690040][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.700021][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.708438][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.715516][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.724601][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.732849][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.739960][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.752276][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.761643][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.776951][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.787523][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.795653][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.803277][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.811515][ T336] device veth0_vlan entered promiscuous mode [ 26.821026][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.829860][ T336] device veth1_macvtap entered promiscuous mode [ 26.838951][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.849804][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.879900][ T336] syz-executor (336) used greatest stack depth: 21984 bytes left 2026/07/20 05:18:36 executed programs: 0 [ 27.329750][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.336948][ T370] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.344605][ T370] device bridge_slave_0 entered promiscuous mode [ 27.356845][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.363927][ T370] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.371348][ T370] device bridge_slave_1 entered promiscuous mode [ 27.412526][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.419562][ T370] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.426851][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.433894][ T370] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.451365][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.458896][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.466329][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.477778][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.485988][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.493036][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.501775][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.509964][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.517016][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.528472][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.542192][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.550295][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.564260][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.572648][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.583319][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.591429][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.599480][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.607014][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.615081][ T370] device veth0_vlan entered promiscuous mode [ 27.626906][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.635285][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.644604][ T370] device veth1_macvtap entered promiscuous mode [ 27.655392][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.663121][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.671378][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.681808][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.690021][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.713205][ T375] loop2: detected capacity change from 0 to 1024 [ 27.732132][ T375] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 27.753077][ T375] ================================================================== [ 27.761159][ T375] BUG: KASAN: use-after-free in xattr_find_entry+0x2f5/0x300 [ 27.768523][ T375] Read of size 4 at addr ffff88811202b004 by task syz.2.17/375 [ 27.776047][ T375] [ 27.778453][ T375] CPU: 1 PID: 375 Comm: syz.2.17 Not tainted syzkaller #0 [ 27.785591][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 27.795644][ T375] Call Trace: [ 27.798929][ T375] [ 27.801839][ T375] __dump_stack+0x21/0x24 [ 27.806155][ T375] dump_stack_lvl+0x110/0x170 [ 27.810817][ T375] ? __cfi_dump_stack_lvl+0x8/0x8 [ 27.815822][ T375] ? __ext4_get_inode_loc+0x5a2/0xd60 [ 27.821176][ T375] ? xattr_find_entry+0x2f5/0x300 [ 27.826186][ T375] print_address_description+0x71/0x200 [ 27.831734][ T375] print_report+0x4a/0x60 [ 27.836043][ T375] kasan_report+0x122/0x150 [ 27.840528][ T375] ? xattr_find_entry+0x2f5/0x300 [ 27.845542][ T375] __asan_report_load4_noabort+0x14/0x20 [ 27.851157][ T375] xattr_find_entry+0x2f5/0x300 [ 27.856019][ T375] ext4_xattr_ibody_get+0x245/0x4d0 [ 27.861198][ T375] ? __cfi_ext4_xattr_ibody_get+0x10/0x10 [ 27.866908][ T375] ? down_read+0xa6/0xf0 [ 27.871132][ T375] ? __cfi_down_read+0x10/0x10 [ 27.875883][ T375] ext4_xattr_get+0x122/0x650 [ 27.880635][ T375] ? get_cached_acl+0x2a0/0x2f0 [ 27.885517][ T375] ? __kasan_check_write+0x14/0x20 [ 27.890623][ T375] ext4_get_acl+0x85/0x6c0 [ 27.895027][ T375] ? _raw_spin_lock+0x94/0xf0 [ 27.899688][ T375] get_acl+0x16f/0x280 [ 27.903735][ T375] posix_acl_chmod+0xe9/0x260 [ 27.908399][ T375] ext4_setattr+0xd4e/0x1c80 [ 27.912972][ T375] ? current_time+0x19b/0x2c0 [ 27.917639][ T375] ? __cfi_current_time+0x10/0x10 [ 27.922646][ T375] ? __cfi_ext4_setattr+0x10/0x10 [ 27.927656][ T375] notify_change+0xd33/0x1030 [ 27.932321][ T375] chmod_common+0x21a/0x3c0 [ 27.936804][ T375] ? __cfi_chmod_common+0x10/0x10 [ 27.941806][ T375] ? user_path_at_empty+0x162/0x1c0 [ 27.946985][ T375] do_fchmodat+0xd4/0x1a0 [ 27.951295][ T375] ? do_faccessat+0x9b0/0x9b0 [ 27.955952][ T375] ? debug_smp_processor_id+0x17/0x20 [ 27.961309][ T375] __x64_sys_chmod+0x60/0x70 [ 27.965881][ T375] x64_sys_call+0x760/0x9a0 [ 27.970365][ T375] do_syscall_64+0x4c/0xa0 [ 27.974758][ T375] ? clear_bhb_loop+0x30/0x80 [ 27.979432][ T375] ? clear_bhb_loop+0x30/0x80 [ 27.984097][ T375] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.989981][ T375] RIP: 0033:0x7f52db99de99 [ 27.994378][ T375] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.013971][ T375] RSP: 002b:00007ffc3d337a08 EFLAGS: 00000246 ORIG_RAX: 000000000000005a [ 28.022382][ T375] RAX: ffffffffffffffda RBX: 00007f52dbc25fa0 RCX: 00007f52db99de99 [ 28.030334][ T375] RDX: 0000000000000000 RSI: 000000000000023f RDI: 0000200000000180 [ 28.038287][ T375] RBP: 00007f52dba33eaf R08: 0000000000000000 R09: 0000000000000000 [ 28.046247][ T375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.054216][ T375] R13: 00007f52dbc25fac R14: 00007f52dbc25fa0 R15: 00007f52dbc25fa0 [ 28.062172][ T375] [ 28.065228][ T375] [ 28.067539][ T375] Allocated by task 104: [ 28.071757][ T375] kasan_set_track+0x4b/0x70 [ 28.076342][ T375] kasan_save_alloc_info+0x1f/0x30 [ 28.081441][ T375] __kasan_slab_alloc+0x72/0x80 [ 28.086282][ T375] slab_post_alloc_hook+0x4f/0x2d0 [ 28.091378][ T375] kmem_cache_alloc+0x166/0x320 [ 28.096223][ T375] seq_open+0x61/0x130 [ 28.100282][ T375] kernfs_fop_open+0x4de/0xb80 [ 28.105027][ T375] do_dentry_open+0x885/0x11f0 [ 28.109779][ T375] vfs_open+0x73/0x80 [ 28.113741][ T375] path_openat+0x2699/0x2f30 [ 28.118311][ T375] do_filp_open+0x1ee/0x420 [ 28.122794][ T375] do_sys_openat2+0x15e/0x820 [ 28.127566][ T375] __x64_sys_openat+0x136/0x160 [ 28.132497][ T375] x64_sys_call+0x783/0x9a0 [ 28.136991][ T375] do_syscall_64+0x4c/0xa0 [ 28.141390][ T375] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.147267][ T375] [ 28.149570][ T375] The buggy address belongs to the object at ffff88811202b000 [ 28.149570][ T375] which belongs to the cache seq_file of size 136 [ 28.163335][ T375] The buggy address is located 4 bytes inside of [ 28.163335][ T375] 136-byte region [ffff88811202b000, ffff88811202b088) [ 28.176434][ T375] [ 28.178741][ T375] The buggy address belongs to the physical page: [ 28.185133][ T375] page:ffffea0004480ac0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88811202baf0 pfn:0x11202b [ 28.196655][ T375] flags: 0x4000000000000200(slab|zone=1) [ 28.202290][ T375] raw: 4000000000000200 ffffea0004480948 ffffea0004480d48 ffff8881001ec480 [ 28.210940][ T375] raw: ffff88811202baf0 0000000000140000 00000001ffffffff 0000000000000000 [ 28.219500][ T375] page dumped because: kasan: bad access detected [ 28.225975][ T375] page_owner tracks the page as allocated [ 28.231676][ T375] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 104, tgid 104 (udevadm), ts 3816911862, free_ts 3816889904 [ 28.249197][ T375] post_alloc_hook+0x1f5/0x210 [ 28.253960][ T375] prep_new_page+0x1c/0x110 [ 28.258459][ T375] get_page_from_freelist+0x2ca9/0x2d20 [ 28.264167][ T375] __alloc_pages+0x1fa/0x610 [ 28.268764][ T375] alloc_slab_page+0x6e/0xf0 [ 28.273354][ T375] new_slab+0x98/0x3e0 [ 28.277413][ T375] ___slab_alloc+0x70f/0xb70 [ 28.281992][ T375] __slab_alloc+0x5e/0xa0 [ 28.286312][ T375] kmem_cache_alloc+0x1a8/0x320 [ 28.291146][ T375] seq_open+0x61/0x130 [ 28.295207][ T375] kernfs_fop_open+0x4de/0xb80 [ 28.299953][ T375] do_dentry_open+0x885/0x11f0 [ 28.304702][ T375] vfs_open+0x73/0x80 [ 28.308669][ T375] path_openat+0x2699/0x2f30 [ 28.313244][ T375] do_filp_open+0x1ee/0x420 [ 28.317731][ T375] do_sys_openat2+0x15e/0x820 [ 28.322393][ T375] page last free stack trace: [ 28.327046][ T375] free_unref_page_prepare+0x80c/0x820 [ 28.332491][ T375] free_unref_page+0x93/0x530 [ 28.337153][ T375] __free_pages+0x67/0x100 [ 28.341553][ T375] free_pages+0x82/0x90 [ 28.345706][ T375] selinux_genfs_get_sid+0x20b/0x250 [ 28.350975][ T375] inode_doinit_with_dentry+0x884/0xd90 [ 28.356503][ T375] selinux_d_instantiate+0x27/0x40 [ 28.361596][ T375] security_d_instantiate+0xb3/0x110 [ 28.366864][ T375] d_splice_alias+0x6d/0x390 [ 28.371436][ T375] kernfs_iop_lookup+0x2c2/0x310 [ 28.376357][ T375] path_openat+0x13fe/0x2f30 [ 28.380930][ T375] do_filp_open+0x1ee/0x420 [ 28.385415][ T375] do_sys_openat2+0x15e/0x820 [ 28.390077][ T375] __x64_sys_openat+0x136/0x160 [ 28.394909][ T375] x64_sys_call+0x783/0x9a0 [ 28.399397][ T375] do_syscall_64+0x4c/0xa0 [ 28.403803][ T375] [ 28.406396][ T375] Memory state around the buggy address: [ 28.412030][ T375] ffff88811202af00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.420068][ T375] ffff88811202af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.428194][ T375] >ffff88811202b000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.436275][ T375] ^ [ 28.440322][ T375] ffff88811202b080: fb fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb [ 28.448366][ T375] ffff88811202b100: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 28.456406][ T375] ================================================================== [ 28.468189][ T375] Disabling lock debugging due to kernel taint [ 28.474502][ T375] EXT4-fs error (device loop2): xattr_find_entry:297: inode #12: comm syz.2.17: corrupted xattr entries [ 28.493845][ T370] EXT4-fs (loop2): unmounting filesystem.