Warning: Permanently added '10.128.1.162' (ED25519) to the list of known hosts. 2026/07/07 10:43:11 parsed 1 programs 2026/07/07 10:43:11 serving rpc on tcp://39745 [ 20.676225][ T30] audit: type=1400 audit(1783420991.611:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 20.680075][ T30] audit: type=1400 audit(1783420991.611:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 21.304820][ T30] audit: type=1400 audit(1783420992.241:66): avc: denied { mounton } for pid=299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.305926][ T299] cgroup: Unknown subsys name 'net' [ 21.327691][ T30] audit: type=1400 audit(1783420992.241:67): avc: denied { mount } for pid=299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.354777][ T30] audit: type=1400 audit(1783420992.271:68): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.354949][ T299] cgroup: Unknown subsys name 'devices' [ 21.469392][ T299] cgroup: Unknown subsys name 'hugetlb' [ 21.474996][ T299] cgroup: Unknown subsys name 'rlimit' [ 21.616825][ T30] audit: type=1400 audit(1783420992.551:69): avc: denied { setattr } for pid=299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.640016][ T30] audit: type=1400 audit(1783420992.551:70): avc: denied { create } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.652275][ T303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.660547][ T30] audit: type=1400 audit(1783420992.551:71): avc: denied { write } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.689170][ T30] audit: type=1400 audit(1783420992.551:72): avc: denied { read } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.709347][ T30] audit: type=1400 audit(1783420992.551:73): avc: denied { mounton } for pid=299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.739019][ T299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.121848][ T305] request_module fs-gadgetfs succeeded, but still no fs? [ 22.623829][ T343] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.630912][ T343] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.638355][ T343] device bridge_slave_0 entered promiscuous mode [ 22.645106][ T343] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.652149][ T343] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.659641][ T343] device bridge_slave_1 entered promiscuous mode [ 22.694482][ T343] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.701543][ T343] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.708865][ T343] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.715881][ T343] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.731759][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.739689][ T332] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.746859][ T332] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.755440][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.763810][ T332] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.770857][ T332] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.779197][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.787367][ T332] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.794401][ T332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.805407][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.814679][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.826896][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.837823][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.845775][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.853342][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.861504][ T343] device veth0_vlan entered promiscuous mode [ 22.870472][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.879408][ T343] device veth1_macvtap entered promiscuous mode [ 22.888143][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.898176][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.924767][ T343] syz-executor (343) used greatest stack depth: 21440 bytes left 2026/07/07 10:43:14 executed programs: 0 [ 23.255038][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.262151][ T368] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.269606][ T368] device bridge_slave_0 entered promiscuous mode [ 23.276513][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.283619][ T368] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.291226][ T368] device bridge_slave_1 entered promiscuous mode [ 23.342602][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.349686][ T368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.356931][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.363970][ T368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.384188][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.391766][ T332] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.399311][ T332] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.409147][ T332] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.417284][ T332] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.424350][ T332] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.438123][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.446214][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.453239][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.460767][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.468768][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.483536][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.494030][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.502112][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.509730][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.518689][ T368] device veth0_vlan entered promiscuous mode [ 23.527193][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.535365][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.544466][ T368] device veth1_macvtap entered promiscuous mode [ 23.553118][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.560854][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.569111][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.578313][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.586573][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.624243][ C0] ================================================================== [ 23.632345][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 23.639747][ C0] Read of size 8 at addr ffff88811d71a190 by task ksoftirqd/0/13 [ 23.647466][ C0] [ 23.649799][ C0] CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted syzkaller #0 [ 23.657081][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 23.667161][ C0] Call Trace: [ 23.670441][ C0] [ 23.673365][ C0] __dump_stack+0x21/0x30 [ 23.677697][ C0] dump_stack_lvl+0x110/0x170 [ 23.682379][ C0] ? show_regs_print_info+0x20/0x20 [ 23.687587][ C0] ? load_image+0x3f0/0x3f0 [ 23.692097][ C0] print_address_description+0x7f/0x2c0 [ 23.697651][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 23.702680][ C0] kasan_report+0x10f/0x150 [ 23.707186][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 23.712214][ C0] __asan_report_load8_noabort+0x14/0x20 [ 23.717853][ C0] rcu_cblist_dequeue+0x6c/0xb0 [ 23.722705][ C0] rcu_do_batch+0x47d/0xbf0 [ 23.727211][ C0] ? local_bh_enable+0x20/0x20 [ 23.731972][ C0] ? __kasan_check_write+0x14/0x20 [ 23.737089][ C0] ? _raw_spin_lock+0xf0/0xf0 [ 23.741770][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 23.747568][ C0] ? rcu_report_qs_rnp+0x2bc/0x390 [ 23.752665][ C0] rcu_core+0x4a3/0xef0 [ 23.756806][ C0] ? rcu_cpu_kthread_park+0x90/0x90 [ 23.761988][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 23.767515][ C0] ? rcu_softirq_qs+0xd7/0x2f0 [ 23.772261][ C0] ? rcu_get_gp_kthreads_prio+0x10/0x10 [ 23.777788][ C0] ? irqtime_account_irq+0x76/0x390 [ 23.782974][ C0] rcu_core_si+0x9/0x10 [ 23.787112][ C0] handle_softirqs+0x250/0x560 [ 23.791861][ C0] ? ksoftirqd_should_run+0x20/0x20 [ 23.797041][ C0] run_ksoftirqd+0x28/0x40 [ 23.801442][ C0] smpboot_thread_fn+0x446/0x880 [ 23.806367][ C0] kthread+0x3f5/0x4f0 [ 23.810416][ C0] ? cpu_report_death+0x1b0/0x1b0 [ 23.815426][ C0] ? kthread_blkcg+0xd0/0xd0 [ 23.819997][ C0] ret_from_fork+0x1f/0x30 [ 23.824396][ C0] [ 23.827399][ C0] [ 23.829703][ C0] Allocated by task 373: [ 23.833918][ C0] __kasan_kmalloc+0xd4/0x100 [ 23.838576][ C0] __kmalloc+0x13d/0x2c0 [ 23.842802][ C0] l2tp_session_create+0x39/0xb60 [ 23.847814][ C0] pppol2tp_connect+0xbf5/0x1640 [ 23.852739][ C0] __sys_connect+0x3cb/0x450 [ 23.857313][ C0] __x64_sys_connect+0x7a/0x90 [ 23.862059][ C0] x64_sys_call+0x7c/0x9a0 [ 23.866457][ C0] do_syscall_64+0x4c/0xa0 [ 23.870860][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 23.876735][ C0] [ 23.879038][ C0] Freed by task 331: [ 23.882907][ C0] kasan_set_track+0x4a/0x70 [ 23.887482][ C0] kasan_set_free_info+0x23/0x40 [ 23.892399][ C0] ____kasan_slab_free+0x125/0x160 [ 23.897488][ C0] __kasan_slab_free+0x11/0x20 [ 23.902229][ C0] slab_free_freelist_hook+0xc2/0x190 [ 23.907579][ C0] kfree+0xc4/0x270 [ 23.911371][ C0] l2tp_session_put+0xaf/0x1a0 [ 23.916116][ C0] l2tp_session_delete+0x3a9/0x4a0 [ 23.921208][ C0] l2tp_tunnel_del_work+0x180/0x3d0 [ 23.926391][ C0] process_one_work+0x6c8/0xbb0 [ 23.931222][ C0] worker_thread+0xaa0/0x1250 [ 23.935879][ C0] kthread+0x3f5/0x4f0 [ 23.939927][ C0] ret_from_fork+0x1f/0x30 [ 23.944328][ C0] [ 23.946631][ C0] Last potentially related work creation: [ 23.952320][ C0] kasan_save_stack+0x3a/0x60 [ 23.956977][ C0] __kasan_record_aux_stack+0xd2/0x100 [ 23.962420][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 23.968210][ C0] call_rcu+0x10b/0xf60 [ 23.972348][ C0] pppol2tp_release+0x1e3/0x2b0 [ 23.977212][ C0] sock_close+0xb8/0x200 [ 23.981445][ C0] __fput+0x22b/0x900 [ 23.985426][ C0] ____fput+0x15/0x20 [ 23.989397][ C0] task_work_run+0x127/0x190 [ 23.993976][ C0] exit_to_user_mode_loop+0xd0/0xe0 [ 23.999167][ C0] exit_to_user_mode_prepare+0x87/0xd0 [ 24.004624][ C0] syscall_exit_to_user_mode+0x1a/0x30 [ 24.010072][ C0] do_syscall_64+0x58/0xa0 [ 24.014482][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.020357][ C0] [ 24.022661][ C0] The buggy address belongs to the object at ffff88811d71a000 [ 24.022661][ C0] which belongs to the cache kmalloc-512 of size 512 [ 24.036695][ C0] The buggy address is located 400 bytes inside of [ 24.036695][ C0] 512-byte region [ffff88811d71a000, ffff88811d71a200) [ 24.049948][ C0] The buggy address belongs to the page: [ 24.055559][ C0] page:ffffea000475c600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d718 [ 24.065791][ C0] head:ffffea000475c600 order:2 compound_mapcount:0 compound_pincount:0 [ 24.074098][ C0] flags: 0x4000000000010200(slab|head|zone=1) [ 24.080162][ C0] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 24.088724][ C0] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 24.097280][ C0] page dumped because: kasan: bad access detected [ 24.103673][ C0] page_owner tracks the page as allocated [ 24.109376][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 368, ts 23603269149, free_ts 12659460513 [ 24.129764][ C0] post_alloc_hook+0x192/0x1b0 [ 24.134521][ C0] prep_new_page+0x1c/0x110 [ 24.139051][ C0] get_page_from_freelist+0x2c3a/0x2cd0 [ 24.144579][ C0] __alloc_pages+0x1a2/0x460 [ 24.149151][ C0] new_slab+0xa0/0x4d0 [ 24.153198][ C0] ___slab_alloc+0x3ac/0x840 [ 24.157770][ C0] __slab_alloc+0x49/0x90 [ 24.162080][ C0] kmem_cache_alloc_trace+0x146/0x270 [ 24.167435][ C0] blkcg_css_alloc+0x65/0xb90 [ 24.172105][ C0] cgroup_apply_control_enable+0x37b/0xdb0 [ 24.177911][ C0] cgroup_mkdir+0x1171/0x13d0 [ 24.182586][ C0] kernfs_iop_mkdir+0x1a3/0x2b0 [ 24.187424][ C0] vfs_mkdir+0x38b/0x590 [ 24.191649][ C0] do_mkdirat+0x174/0x4d0 [ 24.195970][ C0] __x64_sys_mkdirat+0x89/0xa0 [ 24.200739][ C0] x64_sys_call+0x37e/0x9a0 [ 24.205246][ C0] page last free stack trace: [ 24.209896][ C0] free_unref_page_prepare+0x5fa/0x600 [ 24.215341][ C0] free_unref_page+0xae/0x540 [ 24.219998][ C0] free_compound_page+0x78/0xa0 [ 24.224828][ C0] __put_compound_page+0x77/0xb0 [ 24.229749][ C0] __put_page+0xbc/0xe0 [ 24.233885][ C0] skb_release_data+0x37c/0xa20 [ 24.238722][ C0] __kfree_skb+0x50/0x70 [ 24.242947][ C0] tcp_recvmsg_locked+0x13d1/0x24f0 [ 24.248128][ C0] tcp_recvmsg+0x233/0x770 [ 24.252526][ C0] inet_recvmsg+0x13a/0x470 [ 24.257009][ C0] sock_read_iter+0x2c2/0x380 [ 24.261666][ C0] vfs_read+0x6c0/0xc20 [ 24.265801][ C0] ksys_read+0x14a/0x260 [ 24.270029][ C0] __x64_sys_read+0x7b/0x90 [ 24.274511][ C0] x64_sys_call+0x96d/0x9a0 [ 24.278996][ C0] do_syscall_64+0x4c/0xa0 [ 24.283404][ C0] [ 24.285708][ C0] Memory state around the buggy address: [ 24.291320][ C0] ffff88811d71a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.299360][ C0] ffff88811d71a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.307398][ C0] >ffff88811d71a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.315433][ C0] ^ [ 24.319998][ C0] ffff88811d71a200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc f