syzkaller syzkaller login: [ 15.196698][ T30] audit: type=1400 audit(1784498348.515:59): avc: denied { transition } for pid=223 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.205110][ T30] audit: type=1400 audit(1784498348.515:60): avc: denied { noatsecure } for pid=223 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.209145][ T30] audit: type=1400 audit(1784498348.515:61): avc: denied { write } for pid=223 comm="sh" path="pipe:[14509]" dev="pipefs" ino=14509 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 15.216769][ T30] audit: type=1400 audit(1784498348.515:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.240573][ T30] audit: type=1400 audit(1784498348.515:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 16.973077][ T230] sshd-session (230) used greatest stack depth: 21664 bytes left Warning: Permanently added '10.128.0.112' (ED25519) to the list of known hosts. 2026/07/19 21:59:18 parsed 1 programs 2026/07/19 21:59:18 serving rpc on tcp://34491 [ 24.922550][ T30] audit: type=1400 audit(1784498358.245:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.943581][ T30] audit: type=1400 audit(1784498358.245:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.640316][ T30] audit: type=1400 audit(1784498358.955:66): avc: denied { mounton } for pid=299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.641288][ T299] cgroup: Unknown subsys name 'net' [ 25.663001][ T30] audit: type=1400 audit(1784498358.955:67): avc: denied { mount } for pid=299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.690618][ T30] audit: type=1400 audit(1784498358.985:68): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.690774][ T299] cgroup: Unknown subsys name 'devices' [ 25.803915][ T299] cgroup: Unknown subsys name 'hugetlb' [ 25.809517][ T299] cgroup: Unknown subsys name 'rlimit' [ 25.921275][ T30] audit: type=1400 audit(1784498359.235:69): avc: denied { setattr } for pid=299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.944443][ T30] audit: type=1400 audit(1784498359.235:70): avc: denied { create } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.964845][ T30] audit: type=1400 audit(1784498359.235:71): avc: denied { write } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.970744][ T303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.985227][ T30] audit: type=1400 audit(1784498359.235:72): avc: denied { read } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.013938][ T30] audit: type=1400 audit(1784498359.235:73): avc: denied { mounton } for pid=299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.072637][ T299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.505540][ T305] request_module fs-gadgetfs succeeded, but still no fs? [ 26.822403][ T333] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.829448][ T333] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.836860][ T333] device bridge_slave_0 entered promiscuous mode [ 26.843635][ T333] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.850668][ T333] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.858063][ T333] device bridge_slave_1 entered promiscuous mode [ 26.894921][ T333] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.902078][ T333] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.909430][ T333] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.916498][ T333] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.935291][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.943103][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.950323][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.960113][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.968487][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.975591][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.993372][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.001582][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.008990][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.016438][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.024375][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.036336][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.046939][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.055215][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.062726][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.070664][ T333] device veth0_vlan entered promiscuous mode [ 27.080296][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.089818][ T333] device veth1_macvtap entered promiscuous mode [ 27.099238][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.109023][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/19 21:59:20 executed programs: 0 [ 27.560826][ T366] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.567938][ T366] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.575529][ T366] device bridge_slave_0 entered promiscuous mode [ 27.585456][ T366] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.592509][ T366] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.599807][ T366] device bridge_slave_1 entered promiscuous mode [ 27.638903][ T366] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.645963][ T366] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.653240][ T366] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.660265][ T366] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.680757][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.688501][ T339] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.695760][ T339] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.713577][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.722143][ T339] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.729179][ T339] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.736787][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.745113][ T339] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.752163][ T339] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.759525][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.767489][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.783675][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.795305][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.803154][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.811245][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.819053][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.827358][ T366] device veth0_vlan entered promiscuous mode [ 27.837164][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.845354][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.855380][ T366] device veth1_macvtap entered promiscuous mode [ 27.865327][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.872984][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.881173][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.890653][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.898989][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.921628][ T371] ================================================================== [ 27.929726][ T371] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 [ 27.936737][ T371] Write of size 8 at addr ffff88811c44cd50 by task syz.2.17/371 [ 27.944364][ T371] [ 27.946683][ T371] CPU: 1 PID: 371 Comm: syz.2.17 Not tainted syzkaller #0 [ 27.953782][ T371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 27.963830][ T371] Call Trace: [ 27.967102][ T371] [ 27.970035][ T371] __dump_stack+0x21/0x30 [ 27.974386][ T371] dump_stack_lvl+0x110/0x170 [ 27.979070][ T371] ? show_regs_print_info+0x20/0x20 [ 27.984271][ T371] ? load_image+0x3f0/0x3f0 [ 27.988782][ T371] print_address_description+0x7f/0x2c0 [ 27.994332][ T371] ? mutex_lock+0x8e/0x1c0 [ 27.998747][ T371] kasan_report+0x10f/0x150 [ 28.003241][ T371] ? mutex_lock+0x8e/0x1c0 [ 28.007661][ T371] kasan_check_range+0x249/0x2a0 [ 28.012586][ T371] __kasan_check_write+0x14/0x20 [ 28.017513][ T371] mutex_lock+0x8e/0x1c0 [ 28.021744][ T371] ? wait_for_completion_killable_timeout+0x10/0x10 [ 28.028329][ T371] ? l2tp_session_put+0xaf/0x1a0 [ 28.033317][ T371] ? l2tp_session_delete+0x3a9/0x4a0 [ 28.038607][ T371] pppol2tp_release+0x178/0x2b0 [ 28.043450][ T371] sock_close+0xb8/0x200 [ 28.047681][ T371] ? sock_mmap+0xa0/0xa0 [ 28.051911][ T371] __fput+0x22b/0x900 [ 28.055900][ T371] ____fput+0x15/0x20 [ 28.059886][ T371] task_work_run+0x127/0x190 [ 28.064466][ T371] exit_to_user_mode_loop+0xd0/0xe0 [ 28.069655][ T371] exit_to_user_mode_prepare+0x87/0xd0 [ 28.075245][ T371] syscall_exit_to_user_mode+0x1a/0x30 [ 28.080706][ T371] do_syscall_64+0x58/0xa0 [ 28.085115][ T371] ? clear_bhb_loop+0x50/0xa0 [ 28.089899][ T371] ? clear_bhb_loop+0x50/0xa0 [ 28.094592][ T371] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.100493][ T371] RIP: 0033:0x7fb9039e2e99 [ 28.104898][ T371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.124493][ T371] RSP: 002b:00007ffc65efe528 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 28.132912][ T371] RAX: 0000000000000000 RBX: 00007ffc65efe610 RCX: 00007fb9039e2e99 [ 28.140935][ T371] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 28.148902][ T371] RBP: 0000000000006cfa R08: 0000000000000001 R09: 0000000000000000 [ 28.156867][ T371] R10: 0000001b32d20000 R11: 0000000000000246 R12: 0000000000000000 [ 28.164859][ T371] R13: 00007fb903c6afac R14: 00007fb903c6afa8 R15: 00007fb903c6afa0 [ 28.172823][ T371] [ 28.175845][ T371] [ 28.178182][ T371] Allocated by task 371: [ 28.182708][ T371] __kasan_kmalloc+0xd4/0x100 [ 28.187418][ T371] __kmalloc+0x13d/0x2c0 [ 28.191657][ T371] l2tp_session_create+0x39/0xb60 [ 28.196681][ T371] pppol2tp_connect+0xbf5/0x1640 [ 28.201627][ T371] __sys_connect+0x3cb/0x450 [ 28.206205][ T371] __x64_sys_connect+0x7a/0x90 [ 28.210969][ T371] x64_sys_call+0x7c/0x9a0 [ 28.215374][ T371] do_syscall_64+0x4c/0xa0 [ 28.219779][ T371] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.225659][ T371] [ 28.227971][ T371] Freed by task 371: [ 28.231843][ T371] kasan_set_track+0x4a/0x70 [ 28.236442][ T371] kasan_set_free_info+0x23/0x40 [ 28.241377][ T371] ____kasan_slab_free+0x125/0x160 [ 28.246507][ T371] __kasan_slab_free+0x11/0x20 [ 28.251267][ T371] slab_free_freelist_hook+0xc2/0x190 [ 28.256623][ T371] kfree+0xc4/0x270 [ 28.260584][ T371] l2tp_session_put+0xaf/0x1a0 [ 28.265349][ T371] l2tp_session_delete+0x3a9/0x4a0 [ 28.270454][ T371] pppol2tp_release+0x169/0x2b0 [ 28.275396][ T371] sock_close+0xb8/0x200 [ 28.279815][ T371] __fput+0x22b/0x900 [ 28.283780][ T371] ____fput+0x15/0x20 [ 28.287748][ T371] task_work_run+0x127/0x190 [ 28.292320][ T371] exit_to_user_mode_loop+0xd0/0xe0 [ 28.297501][ T371] exit_to_user_mode_prepare+0x87/0xd0 [ 28.302946][ T371] syscall_exit_to_user_mode+0x1a/0x30 [ 28.308391][ T371] do_syscall_64+0x58/0xa0 [ 28.312791][ T371] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.318671][ T371] [ 28.320997][ T371] The buggy address belongs to the object at ffff88811c44cc00 [ 28.320997][ T371] which belongs to the cache kmalloc-512 of size 512 [ 28.335042][ T371] The buggy address is located 336 bytes inside of [ 28.335042][ T371] 512-byte region [ffff88811c44cc00, ffff88811c44ce00) [ 28.348301][ T371] The buggy address belongs to the page: [ 28.353951][ T371] page:ffffea0004711300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11c44c [ 28.364392][ T371] head:ffffea0004711300 order:2 compound_mapcount:0 compound_pincount:0 [ 28.372735][ T371] flags: 0x4000000000010200(slab|head|zone=1) [ 28.378802][ T371] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 28.387463][ T371] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 28.396028][ T371] page dumped because: kasan: bad access detected [ 28.402431][ T371] page_owner tracks the page as allocated [ 28.408223][ T371] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 366, ts 27910747723, free_ts 16536088430 [ 28.428622][ T371] post_alloc_hook+0x192/0x1b0 [ 28.433467][ T371] prep_new_page+0x1c/0x110 [ 28.437977][ T371] get_page_from_freelist+0x2c3a/0x2cd0 [ 28.443567][ T371] __alloc_pages+0x1a2/0x460 [ 28.448146][ T371] new_slab+0xa0/0x4d0 [ 28.452269][ T371] ___slab_alloc+0x3ac/0x840 [ 28.456865][ T371] __slab_alloc+0x49/0x90 [ 28.461220][ T371] kmem_cache_alloc_trace+0x146/0x270 [ 28.466582][ T371] ipv6_add_addr+0x408/0xd90 [ 28.471159][ T371] inet6_addr_add+0x446/0x9d0 [ 28.475821][ T371] inet6_rtm_newaddr+0x6e7/0x9c0 [ 28.480742][ T371] rtnetlink_rcv_msg+0x9fd/0xcb0 [ 28.485664][ T371] netlink_rcv_skb+0x1e9/0x430 [ 28.490414][ T371] rtnetlink_rcv+0x1c/0x20 [ 28.494815][ T371] netlink_unicast+0x86c/0xa30 [ 28.499569][ T371] netlink_sendmsg+0x879/0xb80 [ 28.504323][ T371] page last free stack trace: [ 28.508978][ T371] free_unref_page_prepare+0x5fa/0x600 [ 28.514425][ T371] free_unref_page+0xae/0x540 [ 28.519084][ T371] free_compound_page+0x78/0xa0 [ 28.523926][ T371] __put_compound_page+0x77/0xb0 [ 28.528856][ T371] __put_page+0xbc/0xe0 [ 28.533072][ T371] skb_release_data+0x37c/0xa20 [ 28.538108][ T371] __kfree_skb+0x50/0x70 [ 28.542349][ T371] tcp_recvmsg_locked+0x13d1/0x24f0 [ 28.547539][ T371] tcp_recvmsg+0x233/0x770 [ 28.551940][ T371] inet_recvmsg+0x13a/0x470 [ 28.556434][ T371] sock_read_iter+0x2c2/0x380 [ 28.561122][ T371] vfs_read+0x6c0/0xc20 [ 28.565276][ T371] ksys_read+0x14a/0x260 [ 28.569511][ T371] __x64_sys_read+0x7b/0x90 [ 28.574009][ T371] x64_sys_call+0x96d/0x9a0 [ 28.578615][ T371] do_syscall_64+0x4c/0xa0 [ 28.583018][ T371] [ 28.585336][ T371] Memory state around the buggy address: [ 28.590959][ T371] ffff88811c44cc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.599013][ T371] ffff88811c44cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.607103][ T371] >ffff88811c44cd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.615258][ T371] ^ [ 28.621938][ T371] ffff88811c44cd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.629985][ T371] ffff88811c44ce00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.638028][ T371] ================================================================== [ 28.646068][ T371] Disabling lock debugging due to kernel taint