Warning: Permanently added '10.128.1.71' (ED25519) to the list of known hosts. 2026/11/08 08:22:15 parsed 1 programs 2026/11/08 08:22:15 serving rpc on tcp://37823 [ 20.087757][ T28] audit: type=1400 audit(1794126135.491:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 20.108622][ T28] audit: type=1400 audit(1794126135.491:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 20.872902][ T28] audit: type=1400 audit(1794126136.281:66): avc: denied { mounton } for pid=303 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.873945][ T303] cgroup: Unknown subsys name 'net' [ 20.895623][ T28] audit: type=1400 audit(1794126136.281:67): avc: denied { mount } for pid=303 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.922948][ T28] audit: type=1400 audit(1794126136.311:68): avc: denied { unmount } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.923112][ T303] cgroup: Unknown subsys name 'devices' [ 21.061707][ T303] cgroup: Unknown subsys name 'hugetlb' [ 21.067344][ T303] cgroup: Unknown subsys name 'rlimit' [ 21.174505][ T28] audit: type=1400 audit(1794126136.581:69): avc: denied { setattr } for pid=303 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.197676][ T28] audit: type=1400 audit(1794126136.581:70): avc: denied { create } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.218104][ T28] audit: type=1400 audit(1794126136.581:71): avc: denied { write } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.238469][ T28] audit: type=1400 audit(1794126136.581:72): avc: denied { read } for pid=303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.247378][ T306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.258720][ T28] audit: type=1400 audit(1794126136.581:73): avc: denied { mounton } for pid=303 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.341748][ T303] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.039275][ T311] request_module fs-gadgetfs succeeded, but still no fs? [ 22.094231][ T315] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.101390][ T315] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.108694][ T315] device bridge_slave_0 entered promiscuous mode [ 22.115635][ T315] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.122694][ T315] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.130348][ T315] device bridge_slave_1 entered promiscuous mode [ 22.167967][ T315] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.175049][ T315] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.182389][ T315] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.189436][ T315] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.207184][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.214849][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.222200][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.232011][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.240254][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.247276][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.256009][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.264394][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.271476][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.283934][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.293195][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.306316][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.317120][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.325227][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.332859][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.341961][ T315] device veth0_vlan entered promiscuous mode [ 22.351748][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.361029][ T315] device veth1_macvtap entered promiscuous mode [ 22.369700][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.381147][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/11/08 08:22:18 executed programs: 0 [ 23.101588][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.108633][ T370] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.116843][ T370] device bridge_slave_0 entered promiscuous mode [ 23.123742][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.130887][ T370] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.138220][ T370] device bridge_slave_1 entered promiscuous mode [ 23.187165][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.194593][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.203155][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.212974][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.221167][ T321] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.228194][ T321] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.235835][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.247903][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.256326][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.264494][ T321] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.271520][ T321] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.282817][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.295461][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.308521][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.319357][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.327389][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.335369][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.347671][ T370] device veth0_vlan entered promiscuous mode [ 23.357162][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.366333][ T370] device veth1_macvtap entered promiscuous mode [ 23.375431][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.385272][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.394528][ T43] device bridge_slave_1 left promiscuous mode [ 23.400802][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.408141][ T43] device bridge_slave_0 left promiscuous mode [ 23.414476][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.422336][ T43] device veth1_macvtap left promiscuous mode [ 23.428336][ T43] device veth0_vlan left promiscuous mode [ 23.667871][ T376] ================================================================== [ 23.675958][ T376] BUG: KASAN: use-after-free in mutex_lock+0x86/0x1b0 [ 23.682752][ T376] Write of size 8 at addr ffff888113985950 by task syz.2.17/376 [ 23.690399][ T376] [ 23.692710][ T376] CPU: 0 PID: 376 Comm: syz.2.17 Not tainted syzkaller #0 [ 23.699790][ T376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 23.709839][ T376] Call Trace: [ 23.713103][ T376] [ 23.716071][ T376] __dump_stack+0x21/0x24 [ 23.720398][ T376] dump_stack_lvl+0x110/0x170 [ 23.725087][ T376] ? __cfi_dump_stack_lvl+0x8/0x8 [ 23.730116][ T376] ? mutex_lock+0x86/0x1b0 [ 23.734543][ T376] print_address_description+0x71/0x200 [ 23.740097][ T376] print_report+0x4a/0x60 [ 23.744419][ T376] kasan_report+0x122/0x150 [ 23.748913][ T376] ? mutex_lock+0x86/0x1b0 [ 23.753339][ T376] kasan_check_range+0x249/0x2a0 [ 23.758271][ T376] __kasan_check_write+0x14/0x20 [ 23.763184][ T376] mutex_lock+0x86/0x1b0 [ 23.767421][ T376] ? __cfi_mutex_lock+0x10/0x10 [ 23.772253][ T376] ? kfree+0x6f/0xf0 [ 23.776157][ T376] ? l2tp_session_put+0xaf/0x1a0 [ 23.781103][ T376] ? l2tp_session_delete+0x3df/0x4d0 [ 23.786406][ T376] pppol2tp_release+0x178/0x2b0 [ 23.791266][ T376] sock_close+0xc9/0x220 [ 23.795493][ T376] ? __cfi_sock_close+0x10/0x10 [ 23.800328][ T376] __fput+0x1fd/0x8f0 [ 23.804296][ T376] ____fput+0x15/0x20 [ 23.808270][ T376] task_work_run+0x1e1/0x250 [ 23.812877][ T376] ? __cfi_task_work_run+0x10/0x10 [ 23.817983][ T376] ? free_nsproxy+0x21f/0x270 [ 23.822654][ T376] do_exit+0xb0d/0x29f0 [ 23.826821][ T376] ? __cfi_do_exit+0x10/0x10 [ 23.831421][ T376] ? xfd_validate_state+0x70/0x150 [ 23.836545][ T376] ? __kasan_check_write+0x14/0x20 [ 23.841663][ T376] __x64_sys_exit+0x40/0x40 [ 23.846170][ T376] x64_sys_call+0x67/0x9a0 [ 23.850567][ T376] do_syscall_64+0x4c/0xa0 [ 23.854963][ T376] ? clear_bhb_loop+0x30/0x80 [ 23.859620][ T376] ? clear_bhb_loop+0x30/0x80 [ 23.864301][ T376] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 23.870176][ T376] RIP: 0033:0x7f410f79fb19 [ 23.874613][ T376] Code: Unable to access opcode bytes at 0x7f410f79faef. [ 23.881673][ T376] RSP: 002b:00007f4110685ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 23.890112][ T376] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f410f79fb19 [ 23.898086][ T376] RDX: 00007f41106869c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 23.906048][ T376] RBP: 00007f410f837b70 R08: 0000000000000000 R09: 0000000000000058 [ 23.914002][ T376] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 23.921961][ T376] R13: 00007f410fa26038 R14: 00007f410fa25fa0 R15: 00007ffdfe05e8b8 [ 23.929941][ T376] [ 23.932983][ T376] [ 23.935297][ T376] Allocated by task 375: [ 23.939568][ T376] kasan_set_track+0x4b/0x70 [ 23.944144][ T376] kasan_save_alloc_info+0x1f/0x30 [ 23.949229][ T376] __kasan_kmalloc+0x95/0xb0 [ 23.953796][ T376] __kmalloc+0xb4/0x1e0 [ 23.957928][ T376] l2tp_session_create+0x38/0xbd0 [ 23.962932][ T376] pppol2tp_connect+0xbf5/0x1640 [ 23.967847][ T376] __sys_connect+0x3da/0x460 [ 23.972420][ T376] __x64_sys_connect+0x7a/0x90 [ 23.977188][ T376] x64_sys_call+0x88d/0x9a0 [ 23.981703][ T376] do_syscall_64+0x4c/0xa0 [ 23.986113][ T376] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 23.991994][ T376] [ 23.994304][ T376] Freed by task 376: [ 23.998173][ T376] kasan_set_track+0x4b/0x70 [ 24.002744][ T376] kasan_save_free_info+0x2b/0x40 [ 24.007743][ T376] ____kasan_slab_free+0x132/0x180 [ 24.012833][ T376] __kasan_slab_free+0x11/0x20 [ 24.017603][ T376] slab_free_freelist_hook+0xc2/0x190 [ 24.022952][ T376] __kmem_cache_free+0xb7/0x1b0 [ 24.027803][ T376] kfree+0x6f/0xf0 [ 24.031517][ T376] l2tp_session_put+0xaf/0x1a0 [ 24.036284][ T376] l2tp_session_delete+0x3df/0x4d0 [ 24.041386][ T376] pppol2tp_release+0x169/0x2b0 [ 24.046222][ T376] sock_close+0xc9/0x220 [ 24.050464][ T376] __fput+0x1fd/0x8f0 [ 24.054424][ T376] ____fput+0x15/0x20 [ 24.058386][ T376] task_work_run+0x1e1/0x250 [ 24.062952][ T376] do_exit+0xb0d/0x29f0 [ 24.067084][ T376] __cfi___ia32_sys_exit+0x0/0x10 [ 24.072087][ T376] x64_sys_call+0x67/0x9a0 [ 24.076488][ T376] do_syscall_64+0x4c/0xa0 [ 24.080904][ T376] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.086797][ T376] [ 24.089120][ T376] The buggy address belongs to the object at ffff888113985800 [ 24.089120][ T376] which belongs to the cache kmalloc-512 of size 512 [ 24.103149][ T376] The buggy address is located 336 bytes inside of [ 24.103149][ T376] 512-byte region [ffff888113985800, ffff888113985a00) [ 24.116405][ T376] [ 24.118710][ T376] The buggy address belongs to the physical page: [ 24.125094][ T376] page:ffffea00044e6100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113984 [ 24.135361][ T376] head:ffffea00044e6100 order:2 compound_mapcount:0 compound_pincount:0 [ 24.143681][ T376] flags: 0x4000000000010200(slab|head|zone=1) [ 24.149756][ T376] raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100042f00 [ 24.158313][ T376] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 24.166867][ T376] page dumped because: kasan: bad access detected [ 24.173265][ T376] page_owner tracks the page as allocated [ 24.178976][ T376] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 105, tgid 105 (udevd), ts 4542676945, free_ts 0 [ 24.198601][ T376] post_alloc_hook+0x1f5/0x210 [ 24.203355][ T376] prep_new_page+0x1c/0x110 [ 24.207835][ T376] get_page_from_freelist+0x2ca9/0x2d20 [ 24.213384][ T376] __alloc_pages+0x1fa/0x610 [ 24.217964][ T376] alloc_slab_page+0x6e/0xf0 [ 24.222535][ T376] new_slab+0x98/0x3e0 [ 24.226606][ T376] ___slab_alloc+0x70f/0xb70 [ 24.231201][ T376] __slab_alloc+0x5e/0xa0 [ 24.235528][ T376] __kmem_cache_alloc_node+0x204/0x2d0 [ 24.240990][ T376] __kmalloc_node_track_caller+0xa1/0x1e0 [ 24.246689][ T376] __alloc_skb+0x226/0x4a0 [ 24.251232][ T376] alloc_skb_with_frags+0xa8/0x620 [ 24.256330][ T376] sock_alloc_send_pskb+0x87f/0x9a0 [ 24.261504][ T376] unix_dgram_sendmsg+0x5c1/0x1710 [ 24.266597][ T376] sock_write_iter+0x2ea/0x3f0 [ 24.271346][ T376] vfs_write+0x5ef/0xd00 [ 24.275589][ T376] page_owner free stack trace missing [ 24.281111][ T376] [ 24.283411][ T376] Memory state around the buggy address: [ 24.289014][ T376] ffff888113985800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.297079][ T376] ffff888113985880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.305128][ T376] >ffff888113985900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.313186][ T376] ^ [ 24.319855][ T376] ffff888113985980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.327923][ T376] ffff888113985a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.335962][ T376] ================================================================== [ 24.352334][ T376] Disabling lock debugging due to kernel taint 2026/11/08 08:22:23 executed programs: 198 [ 29.574151][ T1141] ------------[ cut here ]------------ [ 29.579660][ T1141] WARNING: CPU: 0 PID: 1141 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 29.589886][ T1141] Modules linked in: [ 29.593780][ T1141] CPU: 0 PID: 1141 Comm: syz.2.272 Tainted: G B syzkaller #0 [ 29.602629][ T1141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 29.612800][ T1141] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 29.619117][ T1141] Code: 5d c3 e8 3c b8 d4 fc be 02 00 00 00 eb 0a e8 30 b8 d4 fc be 01 00 00 00 4c 89 f7 e8 73 bd cc fd e9 0f ff ff ff e8 19 b8 d4 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 08 b8 d4 fc 4c 89 f7 be 03 [ 29.639015][ T1141] RSP: 0018:ffffc90001bbfb90 EFLAGS: 00010293 [ 29.645172][ T1141] RAX: ffffffff849cba07 RBX: ffff888119e1a000 RCX: ffff888119ead100 [ 29.653226][ T1141] RDX: 0000000000000000 RSI: 00000000192adb00 RDI: 000000000c04eb7d [ 29.661259][ T1141] RBP: ffffc90001bbfbb0 R08: ffff888119e1a083 R09: 1ffff110233c3410 [ 29.669233][ T1141] R10: dffffc0000000000 R11: ffffed10233c3411 R12: dffffc0000000000 [ 29.677290][ T1141] R13: dffffc0000000000 R14: 00000000192adb00 R15: ffff888117089400 [ 29.685298][ T1141] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 29.694475][ T1141] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.701194][ T1141] CR2: 0000200000000240 CR3: 000000000700f000 CR4: 00000000003506b0 [ 29.709188][ T1141] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.717177][ T1141] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.725166][ T1141] Call Trace: [ 29.728430][ T1141] [ 29.731364][ T1141] pppol2tp_release+0x150/0x2b0 [ 29.736219][ T1141] sock_close+0xc9/0x220 [ 29.740478][ T1141] ? __cfi_sock_close+0x10/0x10 [ 29.745323][ T1141] __fput+0x1fd/0x8f0 [ 29.749291][ T1141] ____fput+0x15/0x20 [ 29.753316][ T1141] task_work_run+0x1e1/0x250 [ 29.757904][ T1141] ? __cfi_task_work_run+0x10/0x10 [ 29.763045][ T1141] ? free_nsproxy+0x21f/0x270 [ 29.767721][ T1141] do_exit+0xb0d/0x29f0 [ 29.771996][ T1141] ? __cfi_do_exit+0x10/0x10 [ 29.776589][ T1141] ? xfd_validate_state+0x70/0x150 [ 29.781715][ T1141] ? __kasan_check_write+0x14/0x20 [ 29.786826][ T1141] __x64_sys_exit+0x40/0x40 [ 29.791358][ T1141] x64_sys_call+0x67/0x9a0 [ 29.795775][ T1141] do_syscall_64+0x4c/0xa0 [ 29.800226][ T1141] ? clear_bhb_loop+0x30/0x80 [ 29.804909][ T1141] ? clear_bhb_loop+0x30/0x80 [ 29.809588][ T1141] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 29.815502][ T1141] RIP: 0033:0x7f410f79fb19 [ 29.819923][ T1141] Code: Unable to access opcode bytes at 0x7f410f79faef. [ 29.826919][ T1141] RSP: 002b:00007f4110685ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 29.835338][ T1141] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f410f79fb19 [ 29.843340][ T1141] RDX: 00007f41106869c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 29.851338][ T1141] RBP: 00007f410f837b70 R08: 0000000000000000 R09: 0000000000000058 [ 29.859300][ T1141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.867288][ T1141] R13: 00007f410fa26038 R14: 00007f410fa25fa0 R15: 00007ffdfe05e8b8 [ 29.875272][ T1141] [ 29.878277][ T1141] ---[ end trace 0000000000000000 ]--- [ 29.908264][ T1180] ------------[ cut here ]------------ [ 29.913832][ T1180] WARNING: CPU: 1 PID: 1180 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 29.923954][ T1180] Modules linked in: [ 29.927839][ T1180] CPU: 1 PID: 1180 Comm: syz.2.285 Tainted: G B W syzkaller #0 [ 29.936658][ T1180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 29.946725][ T1180] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 29.953068][ T1180] Code: 5d c3 e8 3c b8 d4 fc be 02 00 00 00 eb 0a e8 30 b8 d4 fc be 01 00 00 00 4c 89 f7 e8 73 bd cc fd e9 0f ff ff ff e8 19 b8 d4 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 08 b8 d4 fc 4c 89 f7 be 03 [ 29.972730][ T1180] RSP: 0018:ffffc9000235fb90 EFLAGS: 00010293 [ 29.978803][ T1180] RAX: ffffffff849cba07 RBX: ffff88811a161000 RCX: ffff88811a16a880 [ 29.986802][ T1180] RDX: 0000000000000000 RSI: 000000002cb2ab00 RDI: 000000000c04eb7d [ 29.994799][ T1180] RBP: ffffc9000235fbb0 R08: ffff88811a161083 R09: 1ffff1102342c210 [ 30.002803][ T1180] R10: dffffc0000000000 R11: ffffed102342c211 R12: dffffc0000000000 [ 30.010794][ T1180] R13: dffffc0000000000 R14: 000000002cb2ab00 R15: ffff8881139abc00 [ 30.018804][ T1180] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 30.027781][ T1180] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 30.034393][ T1180] CR2: 00007f410fa27dac CR3: 000000000700f000 CR4: 00000000003506a0 [ 30.042384][ T1180] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 30.050365][ T1180] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 30.058316][ T1180] Call Trace: [ 30.061600][ T1180] [ 30.064519][ T1180] pppol2tp_release+0x150/0x2b0 [ 30.069353][ T1180] sock_close+0xc9/0x220 [ 30.073631][ T1180] ? __cfi_sock_close+0x10/0x10 [ 30.078474][ T1180] __fput+0x1fd/0x8f0 [ 30.082472][ T1180] ____fput+0x15/0x20 [ 30.086474][ T1180] task_work_run+0x1e1/0x250 [ 30.091128][ T1180] ? __cfi_task_work_run+0x10/0x10 [ 30.096233][ T1180] ? free_nsproxy+0x21f/0x270 [ 30.100920][ T1180] do_exit+0xb0d/0x29f0 [ 30.105072][ T1180] ? __cfi_do_exit+0x10/0x10 [ 30.109639][ T1180] ? xfd_validate_state+0x70/0x150 [ 30.114760][ T1180] ? __kasan_check_write+0x14/0x20 [ 30.119887][ T1180] __x64_sys_exit+0x40/0x40 [ 30.124380][ T1180] x64_sys_call+0x67/0x9a0 [ 30.128768][ T1180] do_syscall_64+0x4c/0xa0 [ 30.133180][ T1180] ? clear_bhb_loop+0x30/0x80 [ 30.137852][ T1180] ? clear_bhb_loop+0x30/0x80 [ 30.142533][ T1180] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 30.148425][ T1180] RIP: 0033:0x7f410f79fb19 [ 30.152867][ T1180] Code: Unable to access opcode bytes at 0x7f410f79faef. [ 30.159900][ T1180] RSP: 002b:00007f4110685ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 30.168316][ T1180] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f410f79fb19 [ 30.176315][ T1180] RDX: 00007f41106869c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 30.184349][ T1180] RBP: 00007f410f837b70 R08: 0000000000000000 R09: 0000000000000058 [ 30.192353][ T1180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 30.200325][ T1180] R13: 00007f410fa26038 R14: 00007f410fa25fa0 R15: 00007ffdfe05e8b8 [ 30.208305][ T1180] [ 30.211335][ T1180] ---[ end trace 0000000000000000 ]--- 2026/11/08 08:22:28 executed programs: 396 [ 33.288491][ T1567] ------------[ cut here ]------------ [ 33.294061][ T1567] WARNING: CPU: 1 PID: 1567 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.304178][ T1567] Modules linked in: [ 33.308116][ T1567] CPU: 1 PID: 1567 Comm: syz.2.414 Tainted: G B W syzkaller #0 [ 33.316898][ T1567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 33.326990][ T1567] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.333379][ T1567] Code: 5d c3 e8 3c b8 d4 fc be 02 00 00 00 eb 0a e8 30 b8 d4 fc be 01 00 00 00 4c 89 f7 e8 73 bd cc fd e9 0f ff ff ff e8 19 b8 d4 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 08 b8 d4 fc 4c 89 f7 be 03 [ 33.353043][ T1567] RSP: 0018:ffffc9000396fb90 EFLAGS: 00010293 [ 33.359112][ T1567] RAX: ffffffff849cba07 RBX: ffff88811c210000 RCX: ffff88811c1ba880 [ 33.367131][ T1567] RDX: 0000000000000000 RSI: 000000001b7f6680 RDI: 000000000c04eb7d [ 33.375125][ T1567] RBP: ffffc9000396fbb0 R08: ffff88811c210083 R09: 1ffff11023842010 [ 33.383117][ T1567] R10: dffffc0000000000 R11: ffffed1023842011 R12: dffffc0000000000 [ 33.391109][ T1567] R13: dffffc0000000000 R14: 000000001b7f6680 R15: ffff88811a286000 [ 33.399078][ T1567] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 33.408020][ T1567] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.414640][ T1567] CR2: 00007f410f760320 CR3: 000000000700f000 CR4: 00000000003506a0 [ 33.422625][ T1567] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.430614][ T1567] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.438591][ T1567] Call Trace: [ 33.441894][ T1567] [ 33.444824][ T1567] pppol2tp_release+0x150/0x2b0 [ 33.449677][ T1567] sock_close+0xc9/0x220 [ 33.453941][ T1567] ? __cfi_sock_close+0x10/0x10 [ 33.458794][ T1567] __fput+0x1fd/0x8f0 [ 33.462799][ T1567] ____fput+0x15/0x20 [ 33.466780][ T1567] task_work_run+0x1e1/0x250 [ 33.471383][ T1567] ? __cfi_task_work_run+0x10/0x10 [ 33.476489][ T1567] ? free_nsproxy+0x21f/0x270 [ 33.481179][ T1567] do_exit+0xb0d/0x29f0 [ 33.485335][ T1567] ? __cfi_do_exit+0x10/0x10 [ 33.489947][ T1567] ? xfd_validate_state+0x70/0x150 [ 33.495057][ T1567] ? __kasan_check_write+0x14/0x20 [ 33.500202][ T1567] __x64_sys_exit+0x40/0x40 [ 33.504728][ T1567] x64_sys_call+0x67/0x9a0 [ 33.509135][ T1567] do_syscall_64+0x4c/0xa0 [ 33.513616][ T1567] ? clear_bhb_loop+0x30/0x80 [ 33.518296][ T1567] ? clear_bhb_loop+0x30/0x80 [ 33.522985][ T1567] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 33.528874][ T1567] RIP: 0033:0x7f410f79fb19 [ 33.533308][ T1567] Code: Unable to access opcode bytes at 0x7f410f79faef. [ 33.540334][ T1567] RSP: 002b:00007f4110685ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 33.548781][ T1567] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f410f79fb19 [ 33.556785][ T1567] RDX: 00007f41106869c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 33.564784][ T1567] RBP: 00007f410f837b70 R08: 0000000000000000 R09: 0000000000000058 [ 33.572793][ T1567] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 33.580795][ T1567] R13: 00007f410fa26038 R14: 00007f410fa25fa0 R15: 00007ffdfe05e8b8 [ 33.588757][ T1567] [ 33.591787][ T1567] ---[ end trace 0000000000000000 ]---