syzkaller syzkaller login: [ 22.024881][ T28] kauditd_printk_skb: 31 callbacks suppressed [ 22.024926][ T28] audit: type=1400 audit(1779546206.979:59): avc: denied { transition } for pid=266 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.030329][ T28] audit: type=1400 audit(1779546206.979:60): avc: denied { noatsecure } for pid=266 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.034459][ T28] audit: type=1400 audit(1779546206.989:61): avc: denied { write } for pid=266 comm="sh" path="pipe:[14841]" dev="pipefs" ino=14841 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 22.038172][ T28] audit: type=1400 audit(1779546206.989:62): avc: denied { rlimitinh } for pid=266 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.041377][ T28] audit: type=1400 audit(1779546206.989:63): avc: denied { siginh } for pid=266 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.214' (ED25519) to the list of known hosts. 2026/05/23 14:23:37 parsed 1 programs [ 32.380717][ T28] audit: type=1400 audit(1779546217.329:64): avc: denied { node_bind } for pid=294 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 32.401604][ T28] audit: type=1400 audit(1779546217.339:65): avc: denied { module_request } for pid=294 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 33.529096][ T28] audit: type=1400 audit(1779546218.479:66): avc: denied { mounton } for pid=300 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 33.533736][ T300] cgroup: Unknown subsys name 'net' [ 33.557345][ T28] audit: type=1400 audit(1779546218.479:67): avc: denied { mount } for pid=300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.579657][ T28] audit: type=1400 audit(1779546218.509:68): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.580169][ T300] cgroup: Unknown subsys name 'devices' [ 33.692977][ T300] cgroup: Unknown subsys name 'hugetlb' [ 33.698640][ T300] cgroup: Unknown subsys name 'rlimit' [ 33.841970][ T28] audit: type=1400 audit(1779546218.799:69): avc: denied { setattr } for pid=300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 33.865260][ T28] audit: type=1400 audit(1779546218.799:70): avc: denied { create } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.885833][ T28] audit: type=1400 audit(1779546218.799:71): avc: denied { write } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.906371][ T28] audit: type=1400 audit(1779546218.799:72): avc: denied { read } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.924036][ T304] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 33.927034][ T28] audit: type=1400 audit(1779546218.799:73): avc: denied { mounton } for pid=300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 33.988919][ T300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 34.674540][ T307] request_module fs-gadgetfs succeeded, but still no fs? [ 35.102072][ T337] syz-executor (337) used greatest stack depth: 22112 bytes left [ 35.483659][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.490994][ T356] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.498430][ T356] device bridge_slave_0 entered promiscuous mode [ 35.505651][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.512767][ T356] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.520224][ T356] device bridge_slave_1 entered promiscuous mode [ 35.568732][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.575869][ T356] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.583273][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.590455][ T356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.612763][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.620567][ T350] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.628014][ T350] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.637911][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.646562][ T350] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.653651][ T350] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.663028][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 35.671376][ T350] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.678431][ T350] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.692073][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.706776][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.725942][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 35.737044][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 35.745442][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 35.753286][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 35.768377][ T356] device veth0_vlan entered promiscuous mode [ 35.779039][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 35.788659][ T356] device veth1_macvtap entered promiscuous mode [ 35.798363][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 35.808578][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 35.854936][ T356] syz-executor (356) used greatest stack depth: 21984 bytes left 2026/05/23 14:23:41 executed programs: 0 [ 36.117759][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.125039][ T371] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.132702][ T371] device bridge_slave_0 entered promiscuous mode [ 36.144897][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.152136][ T371] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.159738][ T371] device bridge_slave_1 entered promiscuous mode [ 36.208737][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.215949][ T371] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.223275][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.230327][ T371] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.254620][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 36.262555][ T350] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.269851][ T350] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.279227][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 36.288577][ T350] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.295681][ T350] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.304974][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.313234][ T350] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.320286][ T350] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.334793][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 36.345098][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 36.360079][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 36.373247][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 36.381954][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 36.389539][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 36.398030][ T371] device veth0_vlan entered promiscuous mode [ 36.408577][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.418002][ T371] device veth1_macvtap entered promiscuous mode [ 36.427936][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.438290][ T350] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.517798][ T377] general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT SMP KASAN [ 36.529549][ T377] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f] [ 36.537976][ T377] CPU: 1 PID: 377 Comm: syz.2.17 Not tainted syzkaller #0 [ 36.545401][ T377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 36.555476][ T377] RIP: 0010:do_unlinkat+0x288/0x6d0 [ 36.560729][ T377] Code: 44 89 ee e8 ca 29 ae ff 45 31 e4 41 81 fd 00 00 20 00 41 0f 95 c4 41 83 c4 eb e9 bd 00 00 00 49 8d 7e 30 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 4c 8b 7c 24 18 74 05 e8 a7 ca f3 ff 49 8b 46 30 48 [ 36.580362][ T377] RSP: 0018:ffffc900009a7de0 EFLAGS: 00010207 [ 36.586450][ T377] RAX: 0000000000000009 RBX: 1ffff11024750716 RCX: 0000000000000000 [ 36.594425][ T377] RDX: ffff88811544a880 RSI: 0000000000000000 RDI: 000000000000004e [ 36.602404][ T377] RBP: ffffc900009a7ed0 R08: ffffc900009a7cc7 R09: 1ffff92000134f98 [ 36.610388][ T377] R10: dffffc0000000000 R11: fffff52000134f99 R12: 0000000000000000 [ 36.618451][ T377] R13: dffffc0000000000 R14: 000000000000001e R15: 0000000000000000 [ 36.626574][ T377] FS: 00007fecee82d6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 36.635517][ T377] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.642210][ T377] CR2: 00007fecee80bff8 CR3: 000000012e226000 CR4: 00000000003506a0 [ 36.650223][ T377] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.658205][ T377] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.666362][ T377] Call Trace: [ 36.669647][ T377] [ 36.672587][ T377] ? __check_object_size+0x45a/0x600 [ 36.678003][ T377] ? __cfi_do_unlinkat+0x10/0x10 [ 36.682964][ T377] __x64_sys_unlinkat+0xd8/0xf0 [ 36.687850][ T377] x64_sys_call+0x79f/0x9a0 [ 36.692403][ T377] do_syscall_64+0x4c/0xa0 [ 36.696865][ T377] ? clear_bhb_loop+0x30/0x80 [ 36.701580][ T377] ? clear_bhb_loop+0x30/0x80 [ 36.706290][ T377] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.712218][ T377] RIP: 0033:0x7feced99ce59 [ 36.716662][ T377] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.736292][ T377] RSP: 002b:00007fecee82d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 36.744750][ T377] RAX: ffffffffffffffda RBX: 00007fecedc15fa0 RCX: 00007feced99ce59 [ 36.753107][ T377] RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 36.761112][ T377] RBP: 00007feceda32d6f R08: 0000000000000000 R09: 0000000000000000 [ 36.769127][ T377] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 36.777273][ T377] R13: 00007fecedc16038 R14: 00007fecedc15fa0 R15: 00007ffdaa3ee6c8 [ 36.785286][ T377] [ 36.788342][ T377] Modules linked in: [ 36.793043][ T377] ---[ end trace 0000000000000000 ]--- [ 36.798731][ T377] RIP: 0010:do_unlinkat+0x288/0x6d0 [ 36.804098][ T377] Code: 44 89 ee e8 ca 29 ae ff 45 31 e4 41 81 fd 00 00 20 00 41 0f 95 c4 41 83 c4 eb e9 bd 00 00 00 49 8d 7e 30 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 4c 8b 7c 24 18 74 05 e8 a7 ca f3 ff 49 8b 46 30 48 [ 36.823944][ T377] RSP: 0018:ffffc900009a7de0 EFLAGS: 00010207 [ 36.830266][ T377] RAX: 0000000000000009 RBX: 1ffff11024750716 RCX: 0000000000000000 [ 36.838558][ T377] RDX: ffff88811544a880 RSI: 0000000000000000 RDI: 000000000000004e [ 36.846656][ T377] RBP: ffffc900009a7ed0 R08: ffffc900009a7cc7 R09: 1ffff92000134f98 [ 36.854942][ T377] R10: dffffc0000000000 R11: fffff52000134f99 R12: 0000000000000000 [ 36.863143][ T377] R13: dffffc0000000000 R14: 000000000000001e R15: 0000000000000000 [ 36.871399][ T377] FS: 00007fecee82d6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 36.880489][ T377] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.887397][ T377] CR2: 00007feced9ea540 CR3: 000000012e226000 CR4: 00000000003506b0 [ 36.895806][ T377] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.904120][ T377] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.912370][ T377] Kernel panic - not syncing: Fatal exception [ 36.919061][ T377] Kernel Offset: disabled [ 36.923411][ T377] Rebooting in 86400 seconds..