syzkaller syzkaller login: [ 7.659794][ T106] udevd (106) used greatest stack depth: 21800 bytes left [ 13.567217][ T30] kauditd_printk_skb: 48 callbacks suppressed [ 13.567230][ T30] audit: type=1400 audit(1784121653.910:59): avc: denied { transition } for pid=223 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.574282][ T30] audit: type=1400 audit(1784121653.910:60): avc: denied { noatsecure } for pid=223 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.577868][ T30] audit: type=1400 audit(1784121653.910:61): avc: denied { write } for pid=223 comm="sh" path="pipe:[14619]" dev="pipefs" ino=14619 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 13.583818][ T30] audit: type=1400 audit(1784121653.910:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.591632][ T30] audit: type=1400 audit(1784121653.910:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.960738][ T230] sshd-session (230) used greatest stack depth: 21312 bytes left Warning: Permanently added '10.128.0.113' (ED25519) to the list of known hosts. 2026/07/15 13:21:02 parsed 1 programs 2026/07/15 13:21:02 serving rpc on tcp://35799 [ 22.413328][ T30] audit: type=1400 audit(1784121662.760:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 22.434010][ T30] audit: type=1400 audit(1784121662.760:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 23.038863][ T30] audit: type=1400 audit(1784121663.380:66): avc: denied { mounton } for pid=300 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.039995][ T300] cgroup: Unknown subsys name 'net' [ 23.061597][ T30] audit: type=1400 audit(1784121663.380:67): avc: denied { mount } for pid=300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.088831][ T30] audit: type=1400 audit(1784121663.410:68): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.088957][ T300] cgroup: Unknown subsys name 'devices' [ 23.201336][ T300] cgroup: Unknown subsys name 'hugetlb' [ 23.206924][ T300] cgroup: Unknown subsys name 'rlimit' [ 23.347824][ T30] audit: type=1400 audit(1784121663.690:69): avc: denied { setattr } for pid=300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.371038][ T30] audit: type=1400 audit(1784121663.690:70): avc: denied { create } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.376242][ T303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.391562][ T30] audit: type=1400 audit(1784121663.690:71): avc: denied { write } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.420194][ T30] audit: type=1400 audit(1784121663.690:72): avc: denied { read } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.440434][ T30] audit: type=1400 audit(1784121663.690:73): avc: denied { mounton } for pid=300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.472954][ T300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.859322][ T305] request_module fs-gadgetfs succeeded, but still no fs? [ 24.410350][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.417378][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.424741][ T353] device bridge_slave_0 entered promiscuous mode [ 24.431503][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.438509][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.445877][ T353] device bridge_slave_1 entered promiscuous mode [ 24.478003][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.485037][ T353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.492313][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.499321][ T353] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.515339][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.522890][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.530303][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.538599][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.546858][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.553883][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.562829][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.570928][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.577924][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.588744][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.597583][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.609810][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.620431][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.628297][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.635776][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.649502][ T353] device veth0_vlan entered promiscuous mode [ 24.658432][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.671570][ T353] device veth1_macvtap entered promiscuous mode [ 24.679882][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.689323][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/15 13:21:05 executed programs: 0 [ 24.909425][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.916489][ T367] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.923983][ T367] device bridge_slave_0 entered promiscuous mode [ 24.931162][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.938185][ T367] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.945502][ T367] device bridge_slave_1 entered promiscuous mode [ 24.997457][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.005190][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.013881][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.022219][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.030400][ T314] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.037406][ T314] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.045221][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.053929][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.062265][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.070507][ T314] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.077510][ T314] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.093829][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.102569][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.120135][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.132650][ T367] device veth0_vlan entered promiscuous mode [ 25.140113][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.148036][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.156083][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.166680][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.175839][ T367] device veth1_macvtap entered promiscuous mode [ 25.185452][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.197626][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.217707][ T372] ================================================================== [ 25.225767][ T372] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 [ 25.232540][ T372] Write of size 8 at addr ffff8881079b8550 by task syz.2.17/372 [ 25.240143][ T372] [ 25.242448][ T372] CPU: 0 PID: 372 Comm: syz.2.17 Not tainted syzkaller #0 [ 25.249526][ T372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 25.259559][ T372] Call Trace: [ 25.262816][ T372] [ 25.265723][ T372] __dump_stack+0x21/0x30 [ 25.270036][ T372] dump_stack_lvl+0x110/0x170 [ 25.274691][ T372] ? show_regs_print_info+0x20/0x20 [ 25.279867][ T372] ? load_image+0x3f0/0x3f0 [ 25.284350][ T372] print_address_description+0x7f/0x2c0 [ 25.289873][ T372] ? mutex_lock+0x8e/0x1c0 [ 25.294276][ T372] kasan_report+0x10f/0x150 [ 25.298756][ T372] ? mutex_lock+0x8e/0x1c0 [ 25.303168][ T372] kasan_check_range+0x249/0x2a0 [ 25.308095][ T372] __kasan_check_write+0x14/0x20 [ 25.313028][ T372] mutex_lock+0x8e/0x1c0 [ 25.317246][ T372] ? wait_for_completion_killable_timeout+0x10/0x10 [ 25.323806][ T372] ? l2tp_session_put+0xaf/0x1a0 [ 25.328717][ T372] ? l2tp_session_delete+0x3a9/0x4a0 [ 25.333978][ T372] pppol2tp_release+0x178/0x2b0 [ 25.338802][ T372] sock_close+0xb8/0x200 [ 25.343019][ T372] ? sock_mmap+0xa0/0xa0 [ 25.347235][ T372] __fput+0x22b/0x900 [ 25.351193][ T372] ____fput+0x15/0x20 [ 25.355147][ T372] task_work_run+0x127/0x190 [ 25.359711][ T372] exit_to_user_mode_loop+0xd0/0xe0 [ 25.364884][ T372] exit_to_user_mode_prepare+0x87/0xd0 [ 25.370326][ T372] syscall_exit_to_user_mode+0x1a/0x30 [ 25.375762][ T372] do_syscall_64+0x58/0xa0 [ 25.380153][ T372] ? clear_bhb_loop+0x50/0xa0 [ 25.384817][ T372] ? clear_bhb_loop+0x50/0xa0 [ 25.389469][ T372] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.395347][ T372] RIP: 0033:0x7f9277573e59 [ 25.399741][ T372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.419322][ T372] RSP: 002b:00007ffd2402d1e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 25.427722][ T372] RAX: 0000000000000000 RBX: 00007ffd2402d2d0 RCX: 00007f9277573e59 [ 25.435671][ T372] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 25.443623][ T372] RBP: 000000000000626c R08: 0000000000000001 R09: 0000000000000000 [ 25.451567][ T372] R10: 0000001b32e20000 R11: 0000000000000246 R12: 0000000000000000 [ 25.459514][ T372] R13: 00007f92777fbfac R14: 00007f92777fbfa8 R15: 00007f92777fbfa0 [ 25.467462][ T372] [ 25.470459][ T372] [ 25.472756][ T372] Allocated by task 372: [ 25.476967][ T372] __kasan_kmalloc+0xd4/0x100 [ 25.481621][ T372] __kmalloc+0x13d/0x2c0 [ 25.485839][ T372] l2tp_session_create+0x39/0xb60 [ 25.490837][ T372] pppol2tp_connect+0xbf5/0x1640 [ 25.495750][ T372] __sys_connect+0x3cb/0x450 [ 25.500312][ T372] __x64_sys_connect+0x7a/0x90 [ 25.505049][ T372] x64_sys_call+0x7c/0x9a0 [ 25.509435][ T372] do_syscall_64+0x4c/0xa0 [ 25.513821][ T372] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.519685][ T372] [ 25.521982][ T372] Freed by task 372: [ 25.525846][ T372] kasan_set_track+0x4a/0x70 [ 25.530409][ T372] kasan_set_free_info+0x23/0x40 [ 25.535327][ T372] ____kasan_slab_free+0x125/0x160 [ 25.540408][ T372] __kasan_slab_free+0x11/0x20 [ 25.545146][ T372] slab_free_freelist_hook+0xc2/0x190 [ 25.550487][ T372] kfree+0xc4/0x270 [ 25.554269][ T372] l2tp_session_put+0xaf/0x1a0 [ 25.559003][ T372] l2tp_session_delete+0x3a9/0x4a0 [ 25.564091][ T372] pppol2tp_release+0x169/0x2b0 [ 25.568914][ T372] sock_close+0xb8/0x200 [ 25.573127][ T372] __fput+0x22b/0x900 [ 25.577082][ T372] ____fput+0x15/0x20 [ 25.581040][ T372] task_work_run+0x127/0x190 [ 25.585617][ T372] exit_to_user_mode_loop+0xd0/0xe0 [ 25.590800][ T372] exit_to_user_mode_prepare+0x87/0xd0 [ 25.596237][ T372] syscall_exit_to_user_mode+0x1a/0x30 [ 25.601674][ T372] do_syscall_64+0x58/0xa0 [ 25.606069][ T372] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.611945][ T372] [ 25.614246][ T372] The buggy address belongs to the object at ffff8881079b8400 [ 25.614246][ T372] which belongs to the cache kmalloc-512 of size 512 [ 25.628273][ T372] The buggy address is located 336 bytes inside of [ 25.628273][ T372] 512-byte region [ffff8881079b8400, ffff8881079b8600) [ 25.641530][ T372] The buggy address belongs to the page: [ 25.647167][ T372] page:ffffea00041e6e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1079b8 [ 25.657383][ T372] head:ffffea00041e6e00 order:2 compound_mapcount:0 compound_pincount:0 [ 25.665683][ T372] flags: 0x4000000000010200(slab|head|zone=1) [ 25.671738][ T372] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 25.680298][ T372] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 25.688852][ T372] page dumped because: kasan: bad access detected [ 25.695238][ T372] page_owner tracks the page as allocated [ 25.700931][ T372] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 314, ts 25205840716, free_ts 15231429586 [ 25.719222][ T372] post_alloc_hook+0x192/0x1b0 [ 25.723970][ T372] prep_new_page+0x1c/0x110 [ 25.728451][ T372] get_page_from_freelist+0x2c3a/0x2cd0 [ 25.733976][ T372] __alloc_pages+0x1a2/0x460 [ 25.738546][ T372] new_slab+0xa0/0x4d0 [ 25.742592][ T372] ___slab_alloc+0x3ac/0x840 [ 25.747163][ T372] __slab_alloc+0x49/0x90 [ 25.751472][ T372] __kmalloc+0x16a/0x2c0 [ 25.755690][ T372] fib6_info_alloc+0x34/0xe0 [ 25.760259][ T372] ip6_route_info_create+0x51b/0x14d0 [ 25.765609][ T372] ip6_route_add+0x27/0x130 [ 25.770090][ T372] addrconf_add_linklocal+0x3cd/0x660 [ 25.775437][ T372] addrconf_addr_gen+0x53f/0x6a0 [ 25.780351][ T372] addrconf_init_auto_addrs+0x867/0xbd0 [ 25.785874][ T372] addrconf_notify+0x95d/0xe00 [ 25.790618][ T372] raw_notifier_call_chain+0x90/0x100 [ 25.795967][ T372] page last free stack trace: [ 25.800613][ T372] free_unref_page_prepare+0x5fa/0x600 [ 25.806049][ T372] free_unref_page+0xae/0x540 [ 25.810709][ T372] __free_pages+0x6c/0x100 [ 25.815101][ T372] __free_slab+0xe5/0x1e0 [ 25.819409][ T372] __unfreeze_partials+0x15a/0x190 [ 25.824500][ T372] put_cpu_partial+0xc6/0x120 [ 25.829155][ T372] __slab_free+0x1d4/0x290 [ 25.833551][ T372] ___cache_free+0x104/0x120 [ 25.838119][ T372] qlink_free+0x4d/0x90 [ 25.842251][ T372] qlist_free_all+0x5f/0xb0 [ 25.846732][ T372] kasan_quarantine_reduce+0x14a/0x170 [ 25.852169][ T372] __kasan_slab_alloc+0x2f/0xe0 [ 25.856995][ T372] slab_post_alloc_hook+0x4f/0x2b0 [ 25.862084][ T372] kmem_cache_alloc+0xf7/0x260 [ 25.866828][ T372] new_inode_pseudo+0x7a/0x210 [ 25.871570][ T372] create_pipe_files+0x4f/0x6c0 [ 25.876402][ T372] [ 25.878703][ T372] Memory state around the buggy address: [ 25.884307][ T372] ffff8881079b8400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.892343][ T372] ffff8881079b8480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.900379][ T372] >ffff8881079b8500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.908414][ T372] ^ [ 25.915068][ T372] ffff8881079b8580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.923111][ T372] ffff8881079b8600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.931156][ T372] ================================================================== [ 25.939192][ T372] Disabling lock debugging due to kernel taint