syzkaller syzkaller login: [ 14.960050][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 14.960066][ T30] audit: type=1400 audit(1784491378.072:59): avc: denied { transition } for pid=223 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.970370][ T30] audit: type=1400 audit(1784491378.072:60): avc: denied { noatsecure } for pid=223 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.977008][ T30] audit: type=1400 audit(1784491378.082:61): avc: denied { write } for pid=223 comm="sh" path="pipe:[14805]" dev="pipefs" ino=14805 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.994053][ T30] audit: type=1400 audit(1784491378.082:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.012849][ T30] audit: type=1400 audit(1784491378.082:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.113' (ED25519) to the list of known hosts. 2026/07/19 20:03:08 parsed 1 programs 2026/07/19 20:03:08 serving rpc on tcp://38691 [ 25.010708][ T30] audit: type=1400 audit(1784491388.122:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 25.031975][ T30] audit: type=1400 audit(1784491388.122:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 26.001089][ T30] audit: type=1400 audit(1784491389.112:66): avc: denied { mounton } for pid=299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 26.004798][ T299] cgroup: Unknown subsys name 'net' [ 26.023879][ T30] audit: type=1400 audit(1784491389.112:67): avc: denied { mount } for pid=299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.051746][ T30] audit: type=1400 audit(1784491389.142:68): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.052210][ T299] cgroup: Unknown subsys name 'devices' [ 26.251650][ T299] cgroup: Unknown subsys name 'hugetlb' [ 26.257292][ T299] cgroup: Unknown subsys name 'rlimit' [ 26.404485][ T30] audit: type=1400 audit(1784491389.512:69): avc: denied { setattr } for pid=299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.427751][ T30] audit: type=1400 audit(1784491389.512:70): avc: denied { create } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.448262][ T30] audit: type=1400 audit(1784491389.512:71): avc: denied { write } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.468685][ T30] audit: type=1400 audit(1784491389.512:72): avc: denied { read } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.489198][ T30] audit: type=1400 audit(1784491389.512:73): avc: denied { mounton } for pid=299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.490005][ T303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.549963][ T299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.991370][ T305] request_module fs-gadgetfs succeeded, but still no fs? [ 27.430215][ T330] syz-executor (330) used greatest stack depth: 22144 bytes left [ 27.750694][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.757764][ T356] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.765411][ T356] device bridge_slave_0 entered promiscuous mode [ 27.772414][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.779477][ T356] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.786856][ T356] device bridge_slave_1 entered promiscuous mode [ 27.829639][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.836703][ T356] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.844032][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.851090][ T356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.871818][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.879752][ T316] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.887175][ T316] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.902239][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.910501][ T316] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.917527][ T316] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.926383][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.934749][ T316] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.941828][ T316] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.958651][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.967796][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.981499][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.998089][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.006274][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.013806][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.022496][ T356] device veth0_vlan entered promiscuous mode [ 28.039490][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.048266][ T356] device veth1_macvtap entered promiscuous mode [ 28.057982][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.072953][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.108929][ T356] syz-executor (356) used greatest stack depth: 20864 bytes left 2026/07/19 20:03:11 executed programs: 0 [ 28.321960][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.329817][ T367] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.337535][ T367] device bridge_slave_0 entered promiscuous mode [ 28.344699][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.351840][ T367] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.359383][ T367] device bridge_slave_1 entered promiscuous mode [ 28.429153][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.439249][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.449768][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 28.458206][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.467481][ T316] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.474604][ T316] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.482469][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 28.491075][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.499679][ T316] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.506740][ T316] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.522512][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 28.530286][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.538326][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.557739][ T367] device veth0_vlan entered promiscuous mode [ 28.564231][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.573347][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.581591][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.589202][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.600963][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.610789][ T367] device veth1_macvtap entered promiscuous mode [ 28.621247][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.631733][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.660287][ T374] ================================================================== [ 28.668413][ T374] BUG: KASAN: slab-out-of-bounds in xfrm_policy_inexact_list_reinsert+0x635/0x6e0 [ 28.677666][ T374] Read of size 1 at addr ffff88811158bbf8 by task syz.2.17/374 [ 28.685236][ T374] [ 28.687849][ T374] CPU: 0 PID: 374 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.694980][ T374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 28.705081][ T374] Call Trace: [ 28.708376][ T374] [ 28.711323][ T374] __dump_stack+0x21/0x30 [ 28.715676][ T374] dump_stack_lvl+0x110/0x170 [ 28.720377][ T374] ? show_regs_print_info+0x20/0x20 [ 28.725594][ T374] ? load_image+0x3f0/0x3f0 [ 28.730118][ T374] ? unwind_get_return_address+0x4d/0x90 [ 28.735784][ T374] ? stack_trace_save+0xf0/0xf0 [ 28.740656][ T374] print_address_description+0x7f/0x2c0 [ 28.746225][ T374] ? xfrm_policy_inexact_list_reinsert+0x635/0x6e0 [ 28.752779][ T374] kasan_report+0x10f/0x150 [ 28.757310][ T374] ? xfrm_policy_inexact_list_reinsert+0x635/0x6e0 [ 28.763838][ T374] __asan_report_load1_noabort+0x14/0x20 [ 28.769496][ T374] xfrm_policy_inexact_list_reinsert+0x635/0x6e0 [ 28.775850][ T374] xfrm_policy_inexact_insert_node+0x5c0/0xb60 [ 28.782036][ T374] xfrm_policy_inexact_alloc_chain+0x540/0xb40 [ 28.788218][ T374] xfrm_policy_inexact_insert+0x6a/0x1190 [ 28.793960][ T374] ? __kasan_check_write+0x14/0x20 [ 28.799100][ T374] ? _raw_spin_lock_bh+0x94/0xf0 [ 28.804103][ T374] xfrm_policy_insert+0x12c/0x9c0 [ 28.809154][ T374] xfrm_add_policy+0x4e1/0x840 [ 28.813950][ T374] ? xfrm_dump_sa_done+0xc0/0xc0 [ 28.818910][ T374] xfrm_user_rcv_msg+0x559/0x7f0 [ 28.823881][ T374] ? xfrm_netlink_rcv+0x90/0x90 [ 28.828849][ T374] ? avc_has_perm_noaudit+0x490/0x490 [ 28.834242][ T374] ? x64_sys_call+0x4b/0x9a0 [ 28.838859][ T374] ? selinux_nlmsg_lookup+0x233/0x440 [ 28.844257][ T374] netlink_rcv_skb+0x1e9/0x430 [ 28.849059][ T374] ? xfrm_netlink_rcv+0x90/0x90 [ 28.854254][ T374] ? netlink_ack+0xb10/0xb10 [ 28.858919][ T374] ? wait_for_completion_killable_timeout+0x10/0x10 [ 28.865570][ T374] ? __netlink_lookup+0x387/0x3b0 [ 28.870643][ T374] xfrm_netlink_rcv+0x72/0x90 [ 28.875345][ T374] netlink_unicast+0x86c/0xa30 [ 28.880139][ T374] netlink_sendmsg+0x879/0xb80 [ 28.884949][ T374] ? netlink_getsockopt+0x530/0x530 [ 28.890176][ T374] ? alloc_file+0x59/0x580 [ 28.894617][ T374] ? security_socket_sendmsg+0x82/0xa0 [ 28.900100][ T374] ? netlink_getsockopt+0x530/0x530 [ 28.905332][ T374] ____sys_sendmsg+0x5be/0x8f0 [ 28.910122][ T374] ? __sys_sendmsg_sock+0x40/0x40 [ 28.915196][ T374] ? import_iovec+0x7c/0xb0 [ 28.919723][ T374] ___sys_sendmsg+0x236/0x2e0 [ 28.924429][ T374] ? __sys_sendmsg+0x280/0x280 [ 28.929218][ T374] ? percpu_counter_add_batch+0x13c/0x160 [ 28.934985][ T374] ? __kasan_check_read+0x11/0x20 [ 28.940039][ T374] ? __fdget+0x15b/0x230 [ 28.944307][ T374] __x64_sys_sendmsg+0x201/0x2d0 [ 28.949264][ T374] ? ___sys_sendmsg+0x2e0/0x2e0 [ 28.954138][ T374] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 28.960232][ T374] x64_sys_call+0x4b/0x9a0 [ 28.964718][ T374] do_syscall_64+0x4c/0xa0 [ 28.969159][ T374] ? clear_bhb_loop+0x50/0xa0 [ 28.973857][ T374] ? clear_bhb_loop+0x50/0xa0 [ 28.978558][ T374] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.984488][ T374] RIP: 0033:0x7f7afd686e99 [ 28.988923][ T374] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.008553][ T374] RSP: 002b:00007ffe62ee06d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 29.017288][ T374] RAX: ffffffffffffffda RBX: 00007f7afd90efa0 RCX: 00007f7afd686e99 [ 29.025652][ T374] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000008 [ 29.033771][ T374] RBP: 00007f7afd71ceaf R08: 0000000000000000 R09: 0000000000000000 [ 29.041783][ T374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.049776][ T374] R13: 00007f7afd90efac R14: 00007f7afd90efa0 R15: 00007f7afd90efa0 [ 29.058030][ T374] [ 29.061111][ T374] [ 29.063543][ T374] Allocated by task 374: [ 29.067807][ T374] __kasan_kmalloc+0xd4/0x100 [ 29.072505][ T374] __kmalloc+0x13d/0x2c0 [ 29.076862][ T374] sk_prot_alloc+0xed/0x320 [ 29.081381][ T374] sk_alloc+0x38/0x430 [ 29.085681][ T374] pfkey_create+0x12a/0x650 [ 29.090217][ T374] __sock_create+0x38d/0x7a0 [ 29.094840][ T374] __sys_socket+0xec/0x190 [ 29.099292][ T374] __x64_sys_socket+0x7a/0x90 [ 29.103994][ T374] x64_sys_call+0x8c5/0x9a0 [ 29.108509][ T374] do_syscall_64+0x4c/0xa0 [ 29.112942][ T374] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 29.118866][ T374] [ 29.121213][ T374] The buggy address belongs to the object at ffff88811158b800 [ 29.121213][ T374] which belongs to the cache kmalloc-1k of size 1024 [ 29.135283][ T374] The buggy address is located 1016 bytes inside of [ 29.135283][ T374] 1024-byte region [ffff88811158b800, ffff88811158bc00) [ 29.148768][ T374] The buggy address belongs to the page: [ 29.154436][ T374] page:ffffea0004456200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111588 [ 29.164791][ T374] head:ffffea0004456200 order:3 compound_mapcount:0 compound_pincount:0 [ 29.173241][ T374] flags: 0x4000000000010200(slab|head|zone=1) [ 29.179356][ T374] raw: 4000000000010200 ffffea0004453400 0000000300000003 ffff888100043080 [ 29.187963][ T374] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 29.196570][ T374] page dumped because: kasan: bad access detected [ 29.203006][ T374] page_owner tracks the page as allocated [ 29.208829][ T374] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 110, ts 5771204478, free_ts 0 [ 29.227147][ T374] post_alloc_hook+0x192/0x1b0 [ 29.232033][ T374] prep_new_page+0x1c/0x110 [ 29.236583][ T374] get_page_from_freelist+0x2c3a/0x2cd0 [ 29.242171][ T374] __alloc_pages+0x1a2/0x460 [ 29.246789][ T374] new_slab+0xa0/0x4d0 [ 29.251029][ T374] ___slab_alloc+0x3ac/0x840 [ 29.255653][ T374] __slab_alloc+0x49/0x90 [ 29.259999][ T374] __kmalloc_track_caller+0x169/0x2c0 [ 29.265397][ T374] __alloc_skb+0x210/0x730 [ 29.269828][ T374] netlink_sendmsg+0x611/0xb80 [ 29.274607][ T374] ____sys_sendmsg+0x5be/0x8f0 [ 29.279379][ T374] ___sys_sendmsg+0x236/0x2e0 [ 29.284061][ T374] __x64_sys_sendmsg+0x201/0x2d0 [ 29.289018][ T374] x64_sys_call+0x4b/0x9a0 [ 29.293440][ T374] do_syscall_64+0x4c/0xa0 [ 29.297880][ T374] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 29.303785][ T374] page_owner free stack trace missing [ 29.309319][ T374] [ 29.311662][ T374] Memory state around the buggy address: [ 29.317307][ T374] ffff88811158ba80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.325396][ T374] ffff88811158bb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.333485][ T374] >ffff88811158bb80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 29.341689][ T374] ^ [ 29.349686][ T374] ffff88811158bc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.357861][ T374] ffff88811158bc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.365926][ T374] ================================================================== [ 29.373999][ T374] Disabling lock debugging due to kernel taint