rocess permissive=1 [ 16.066236][ T30] audit: type=1400 audit(1785892969.860:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.111' (ED25519) to the list of known hosts. 2026/08/05 01:23:00 parsed 1 programs 2026/08/05 01:23:00 serving rpc on tcp://39487 [ 27.080713][ T30] audit: type=1400 audit(1785892980.920:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 27.101604][ T30] audit: type=1400 audit(1785892980.920:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 28.049214][ T30] audit: type=1400 audit(1785892981.890:66): avc: denied { mounton } for pid=299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 28.052532][ T299] cgroup: Unknown subsys name 'net' [ 28.071910][ T30] audit: type=1400 audit(1785892981.890:67): avc: denied { mount } for pid=299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.099263][ T30] audit: type=1400 audit(1785892981.920:68): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.099743][ T299] cgroup: Unknown subsys name 'devices' [ 28.239090][ T299] cgroup: Unknown subsys name 'hugetlb' [ 28.244819][ T299] cgroup: Unknown subsys name 'rlimit' [ 28.393165][ T30] audit: type=1400 audit(1785892982.230:69): avc: denied { setattr } for pid=299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.416479][ T30] audit: type=1400 audit(1785892982.230:70): avc: denied { create } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 28.436911][ T303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 28.437460][ T30] audit: type=1400 audit(1785892982.230:71): avc: denied { write } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.466056][ T30] audit: type=1400 audit(1785892982.230:72): avc: denied { read } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.471713][ T299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.486778][ T30] audit: type=1400 audit(1785892982.240:73): avc: denied { mounton } for pid=299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.933745][ T306] request_module fs-gadgetfs succeeded, but still no fs? [ 29.135403][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.143112][ T318] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.150638][ T318] device bridge_slave_0 entered promiscuous mode [ 29.158652][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.165713][ T318] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.173285][ T318] device bridge_slave_1 entered promiscuous mode [ 29.215603][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.222680][ T318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.230019][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.237082][ T318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.257992][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.265378][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.272901][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.280419][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.290487][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.298681][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.305701][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.314304][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.322484][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.329562][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.342000][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.351190][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.364852][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.376641][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.385001][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.392493][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.401516][ T318] device veth0_vlan entered promiscuous mode [ 29.412124][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.421619][ T318] device veth1_macvtap entered promiscuous mode [ 29.430814][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.441898][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.479017][ T318] syz-executor (318) used greatest stack depth: 22024 bytes left [ 29.957858][ T8] device bridge_slave_1 left promiscuous mode [ 29.964038][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.972491][ T8] device bridge_slave_0 left promiscuous mode [ 29.978953][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.007546][ T8] device veth1_macvtap left promiscuous mode [ 30.013638][ T8] device veth0_vlan left promiscuous mode 2026/08/05 01:23:03 executed programs: 0 [ 30.171942][ T366] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.179011][ T366] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.186377][ T366] device bridge_slave_0 entered promiscuous mode [ 30.193292][ T366] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.200338][ T366] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.207780][ T366] device bridge_slave_1 entered promiscuous mode [ 30.249868][ T366] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.256939][ T366] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.264203][ T366] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.271260][ T366] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.289945][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.297748][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.305021][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.314317][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.322513][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.329597][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.338660][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.346889][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.353937][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.365598][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.385751][ T366] device veth0_vlan entered promiscuous mode [ 30.392840][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.401539][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.409946][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.417992][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.425388][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.437427][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.447175][ T366] device veth1_macvtap entered promiscuous mode [ 30.458512][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.467364][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.518422][ T373] ================================================================== [ 30.526535][ T373] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 [ 30.533340][ T373] Write of size 8 at addr ffff88812e2dfd50 by task syz.2.17/373 [ 30.541031][ T373] [ 30.543406][ T373] CPU: 1 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0 [ 30.550547][ T373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.560634][ T373] Call Trace: [ 30.563932][ T373] [ 30.566878][ T373] __dump_stack+0x21/0x30 [ 30.571230][ T373] dump_stack_lvl+0x110/0x170 [ 30.575929][ T373] ? show_regs_print_info+0x20/0x20 [ 30.581144][ T373] ? load_image+0x3f0/0x3f0 [ 30.585673][ T373] print_address_description+0x7f/0x2c0 [ 30.591238][ T373] ? mutex_lock+0x8e/0x1c0 [ 30.595677][ T373] kasan_report+0x10f/0x150 [ 30.600206][ T373] ? mutex_lock+0x8e/0x1c0 [ 30.604639][ T373] kasan_check_range+0x249/0x2a0 [ 30.609596][ T373] __kasan_check_write+0x14/0x20 [ 30.614560][ T373] mutex_lock+0x8e/0x1c0 [ 30.618822][ T373] ? wait_for_completion_killable_timeout+0x10/0x10 [ 30.625469][ T373] ? l2tp_session_put+0xaf/0x1a0 [ 30.630433][ T373] ? l2tp_session_delete+0x3a9/0x4a0 [ 30.635837][ T373] pppol2tp_release+0x178/0x2b0 [ 30.640712][ T373] sock_close+0xb8/0x200 [ 30.644980][ T373] ? sock_mmap+0xa0/0xa0 [ 30.649285][ T373] __fput+0x22b/0x900 [ 30.653378][ T373] ____fput+0x15/0x20 [ 30.657389][ T373] task_work_run+0x127/0x190 [ 30.661998][ T373] do_exit+0xb70/0x29a0 [ 30.666176][ T373] ? finish_task_switch+0x32a/0x790 [ 30.671406][ T373] ? put_task_struct+0x90/0x90 [ 30.676192][ T373] ? __remove_hrtimer+0x157/0x3d0 [ 30.681242][ T373] ? __kasan_check_write+0x14/0x20 [ 30.686381][ T373] ? _raw_spin_lock_irq+0x95/0xf0 [ 30.691427][ T373] do_group_exit+0x149/0x310 [ 30.696041][ T373] ? __kasan_check_write+0x14/0x20 [ 30.701181][ T373] ? recalc_sigpending+0x1c4/0x230 [ 30.706313][ T373] get_signal+0x64f/0x1430 [ 30.710748][ T373] ? usleep_range_state+0x130/0x130 [ 30.715977][ T373] arch_do_signal_or_restart+0xe2/0x1100 [ 30.721646][ T373] ? nanosleep_copyout+0x120/0x120 [ 30.726796][ T373] ? __remove_hrtimer+0x3d0/0x3d0 [ 30.731849][ T373] ? get_timespec64+0x116/0x1b0 [ 30.736720][ T373] ? get_sigframe_size+0x10/0x10 [ 30.741679][ T373] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 30.747345][ T373] exit_to_user_mode_loop+0xa7/0xe0 [ 30.752568][ T373] exit_to_user_mode_prepare+0x87/0xd0 [ 30.758045][ T373] syscall_exit_to_user_mode+0x1a/0x30 [ 30.763533][ T373] do_syscall_64+0x58/0xa0 [ 30.767978][ T373] ? clear_bhb_loop+0x50/0xa0 [ 30.772689][ T373] ? clear_bhb_loop+0x50/0xa0 [ 30.777388][ T373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 30.783308][ T373] RIP: 0033:0x7fc26a4f8197 [ 30.787743][ T373] Code: Unable to access opcode bytes at RIP 0x7fc26a4f816d. [ 30.795113][ T373] RSP: 002b:00007ffda70aa9c0 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 30.803556][ T373] RAX: fffffffffffffdfc RBX: 0000555584b5e500 RCX: 00007fc26a4f8197 [ 30.811548][ T373] RDX: 00007ffda70aaa00 RSI: 0000000000000000 RDI: 0000000000000000 [ 30.819542][ T373] RBP: 00007fc26a5d400c R08: 0000000000000000 R09: 0000000000000000 [ 30.827524][ T373] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 30.835535][ T373] R13: 00007fc26a7c4fac R14: 00007fc26a7c4fa0 R15: 00007fc26a7c4fa0 [ 30.843670][ T373] [ 30.846718][ T373] [ 30.849063][ T373] Allocated by task 372: [ 30.853319][ T373] __kasan_kmalloc+0xd4/0x100 [ 30.858019][ T373] __kmalloc+0x13d/0x2c0 [ 30.862280][ T373] l2tp_session_create+0x39/0xb60 [ 30.867319][ T373] pppol2tp_connect+0xbf5/0x1640 [ 30.872267][ T373] __sys_connect+0x3cb/0x450 [ 30.876871][ T373] __x64_sys_connect+0x7a/0x90 [ 30.881648][ T373] x64_sys_call+0x7c/0x9a0 [ 30.886071][ T373] do_syscall_64+0x4c/0xa0 [ 30.890523][ T373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 30.896437][ T373] [ 30.898775][ T373] Freed by task 373: [ 30.902673][ T373] kasan_set_track+0x4a/0x70 [ 30.907278][ T373] kasan_set_free_info+0x23/0x40 [ 30.912234][ T373] ____kasan_slab_free+0x125/0x160 [ 30.917353][ T373] __kasan_slab_free+0x11/0x20 [ 30.922123][ T373] slab_free_freelist_hook+0xc2/0x190 [ 30.927500][ T373] kfree+0xc4/0x270 [ 30.931318][ T373] l2tp_session_put+0xaf/0x1a0 [ 30.936096][ T373] l2tp_session_delete+0x3a9/0x4a0 [ 30.941217][ T373] pppol2tp_release+0x169/0x2b0 [ 30.946081][ T373] sock_close+0xb8/0x200 [ 30.950331][ T373] __fput+0x22b/0x900 [ 30.954451][ T373] ____fput+0x15/0x20 [ 30.958439][ T373] task_work_run+0x127/0x190 [ 30.963032][ T373] do_exit+0xb70/0x29a0 [ 30.967202][ T373] do_group_exit+0x149/0x310 [ 30.971801][ T373] get_signal+0x64f/0x1430 [ 30.976241][ T373] arch_do_signal_or_restart+0xe2/0x1100 [ 30.981892][ T373] exit_to_user_mode_loop+0xa7/0xe0 [ 30.987119][ T373] exit_to_user_mode_prepare+0x87/0xd0 [ 30.992583][ T373] syscall_exit_to_user_mode+0x1a/0x30 [ 30.998082][ T373] do_syscall_64+0x58/0xa0 [ 31.002507][ T373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 31.008432][ T373] [ 31.010760][ T373] The buggy address belongs to the object at ffff88812e2dfc00 [ 31.010760][ T373] which belongs to the cache kmalloc-512 of size 512 [ 31.024822][ T373] The buggy address is located 336 bytes inside of [ 31.024822][ T373] 512-byte region [ffff88812e2dfc00, ffff88812e2dfe00) [ 31.038187][ T373] The buggy address belongs to the page: [ 31.043845][ T373] page:ffffea0004b8b700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12e2dc [ 31.054102][ T373] head:ffffea0004b8b700 order:2 compound_mapcount:0 compound_pincount:0 [ 31.062428][ T373] flags: 0x4000000000010200(slab|head|zone=1) [ 31.068521][ T373] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 31.077115][ T373] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 31.085703][ T373] page dumped because: kasan: bad access detected [ 31.092205][ T373] page_owner tracks the page as allocated [ 31.097942][ T373] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 366, ts 30484744428, free_ts 0 [ 31.117492][ T373] post_alloc_hook+0x192/0x1b0 [ 31.122271][ T373] prep_new_page+0x1c/0x110 [ 31.126789][ T373] get_page_from_freelist+0x2c3a/0x2cd0 [ 31.132345][ T373] __alloc_pages+0x1a2/0x460 [ 31.136942][ T373] new_slab+0xa0/0x4d0 [ 31.141020][ T373] ___slab_alloc+0x3ac/0x840 [ 31.145616][ T373] __slab_alloc+0x49/0x90 [ 31.149955][ T373] kmem_cache_alloc_trace+0x146/0x270 [ 31.155357][ T373] find_css_set+0x91d/0x1560 [ 31.159956][ T373] cgroup_migrate_prepare_dst+0xc4/0xa00 [ 31.165600][ T373] cgroup_attach_task+0x298/0x520 [ 31.170637][ T373] __cgroup1_procs_write+0x314/0x520 [ 31.175931][ T373] cgroup1_procs_write+0x2a/0x40 [ 31.180878][ T373] cgroup_file_write+0x294/0x560 [ 31.185824][ T373] kernfs_fop_write_iter+0x2bd/0x400 [ 31.191118][ T373] vfs_write+0x831/0xfd0 [ 31.195372][ T373] page_owner free stack trace missing [ 31.200754][ T373] [ 31.203083][ T373] Memory state around the buggy address: [ 31.208718][ T373] ffff88812e2dfc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.216875][ T373] ffff88812e2dfc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.224942][ T373] >ffff88812e2dfd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.233006][ T373] ^ [ 31.239781][ T373] ffff88812e2dfd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.247846][ T373] ffff88812e2dfe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.255911][ T373] ================================================================== [ 31.263995][ T373] Disabling lock debugging due to kernel taint