[ 6.213003][ T30] audit: type=1400 audit(1783733336.027:58): avc: denied { read } for pid=193 comm="getty" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 syzkaller syzkaller login: [ 15.446292][ T30] audit: type=1400 audit(1783733345.297:59): avc: denied { transition } for pid=223 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.453984][ T30] audit: type=1400 audit(1783733345.297:60): avc: denied { noatsecure } for pid=223 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.460752][ T30] audit: type=1400 audit(1783733345.307:61): avc: denied { write } for pid=223 comm="sh" path="pipe:[412]" dev="pipefs" ino=412 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 15.471569][ T30] audit: type=1400 audit(1783733345.307:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.490472][ T30] audit: type=1400 audit(1783733345.307:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.147' (ED25519) to the list of known hosts. 2026/07/11 01:29:15 parsed 1 programs 2026/07/11 01:29:15 serving rpc on tcp://36557 [ 25.205654][ T30] audit: type=1400 audit(1783733355.057:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 25.226818][ T30] audit: type=1400 audit(1783733355.057:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 26.232108][ T30] audit: type=1400 audit(1783733356.077:66): avc: denied { mounton } for pid=299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 26.235856][ T299] cgroup: Unknown subsys name 'net' [ 26.255177][ T30] audit: type=1400 audit(1783733356.087:67): avc: denied { mount } for pid=299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.282623][ T30] audit: type=1400 audit(1783733356.117:68): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.283569][ T299] cgroup: Unknown subsys name 'devices' [ 26.394794][ T299] cgroup: Unknown subsys name 'hugetlb' [ 26.400418][ T299] cgroup: Unknown subsys name 'rlimit' [ 26.548762][ T30] audit: type=1400 audit(1783733356.397:69): avc: denied { setattr } for pid=299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.571992][ T30] audit: type=1400 audit(1783733356.397:70): avc: denied { create } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.592684][ T30] audit: type=1400 audit(1783733356.397:71): avc: denied { write } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.607860][ T304] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.613495][ T30] audit: type=1400 audit(1783733356.397:72): avc: denied { read } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.641811][ T30] audit: type=1400 audit(1783733356.407:73): avc: denied { mounton } for pid=299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.659461][ T299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.138590][ T306] request_module fs-gadgetfs succeeded, but still no fs? [ 27.442931][ T325] syz-executor (325) used greatest stack depth: 21336 bytes left [ 27.777106][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.784360][ T356] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.791803][ T356] device bridge_slave_0 entered promiscuous mode [ 27.798856][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.805919][ T356] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.813396][ T356] device bridge_slave_1 entered promiscuous mode [ 27.856908][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.863986][ T356] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.871299][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.878377][ T356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.897860][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.905842][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.913182][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.922389][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.930699][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.937761][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.946719][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.954950][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.961979][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.975253][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.984856][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.999475][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.011069][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.019402][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.027095][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.035566][ T356] device veth0_vlan entered promiscuous mode [ 28.046258][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.055478][ T356] device veth1_macvtap entered promiscuous mode [ 28.065618][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.081134][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/11 01:29:18 executed programs: 0 [ 28.367548][ T366] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.374768][ T366] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.382148][ T366] device bridge_slave_0 entered promiscuous mode [ 28.389277][ T366] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.396397][ T366] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.403889][ T366] device bridge_slave_1 entered promiscuous mode [ 28.472128][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.479803][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.488826][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 28.497325][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.505494][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.512582][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.520197][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 28.537306][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 28.545802][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.554066][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.561123][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.578713][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.587662][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.602246][ T366] device veth0_vlan entered promiscuous mode [ 28.609336][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.618473][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.626975][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.634623][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.648100][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.657784][ T366] device veth1_macvtap entered promiscuous mode [ 28.668386][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.681244][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.705381][ T371] ================================================================== [ 28.713491][ T371] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 [ 28.720352][ T371] Write of size 8 at addr ffff88812d6a0550 by task syz.2.17/371 [ 28.728014][ T371] [ 28.730372][ T371] CPU: 0 PID: 371 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.737513][ T371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 28.747600][ T371] Call Trace: [ 28.750881][ T371] [ 28.753813][ T371] __dump_stack+0x21/0x30 [ 28.758148][ T371] dump_stack_lvl+0x110/0x170 [ 28.762830][ T371] ? show_regs_print_info+0x20/0x20 [ 28.768045][ T371] ? load_image+0x3f0/0x3f0 [ 28.772559][ T371] print_address_description+0x7f/0x2c0 [ 28.778128][ T371] ? mutex_lock+0x8e/0x1c0 [ 28.782553][ T371] kasan_report+0x10f/0x150 [ 28.787102][ T371] ? mutex_lock+0x8e/0x1c0 [ 28.791519][ T371] kasan_check_range+0x249/0x2a0 [ 28.796727][ T371] __kasan_check_write+0x14/0x20 [ 28.801669][ T371] mutex_lock+0x8e/0x1c0 [ 28.805912][ T371] ? wait_for_completion_killable_timeout+0x10/0x10 [ 28.812522][ T371] ? l2tp_session_put+0xaf/0x1a0 [ 28.817482][ T371] ? l2tp_session_delete+0x3a9/0x4a0 [ 28.822773][ T371] pppol2tp_release+0x178/0x2b0 [ 28.827632][ T371] sock_close+0xb8/0x200 [ 28.831871][ T371] ? sock_mmap+0xa0/0xa0 [ 28.836111][ T371] __fput+0x22b/0x900 [ 28.840099][ T371] ____fput+0x15/0x20 [ 28.844106][ T371] task_work_run+0x127/0x190 [ 28.848721][ T371] exit_to_user_mode_loop+0xd0/0xe0 [ 28.853927][ T371] exit_to_user_mode_prepare+0x87/0xd0 [ 28.859389][ T371] syscall_exit_to_user_mode+0x1a/0x30 [ 28.864844][ T371] do_syscall_64+0x58/0xa0 [ 28.869260][ T371] ? clear_bhb_loop+0x50/0xa0 [ 28.873945][ T371] ? clear_bhb_loop+0x50/0xa0 [ 28.878623][ T371] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.884510][ T371] RIP: 0033:0x7f16c630de59 [ 28.888925][ T371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.908529][ T371] RSP: 002b:00007fffaf851058 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 28.916954][ T371] RAX: 0000000000000000 RBX: 00007fffaf851140 RCX: 00007f16c630de59 [ 28.924928][ T371] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 28.933020][ T371] RBP: 0000000000006fff R08: 0000000000000001 R09: 0000000000000000 [ 28.941006][ T371] R10: 0000001b32d20000 R11: 0000000000000246 R12: 0000000000000000 [ 28.949005][ T371] R13: 00007f16c6595fac R14: 00007f16c6595fa8 R15: 00007f16c6595fa0 [ 28.956990][ T371] [ 28.960014][ T371] [ 28.962335][ T371] Allocated by task 371: [ 28.966569][ T371] __kasan_kmalloc+0xd4/0x100 [ 28.971250][ T371] __kmalloc+0x13d/0x2c0 [ 28.975489][ T371] l2tp_session_create+0x39/0xb60 [ 28.980516][ T371] pppol2tp_connect+0xbf5/0x1640 [ 28.985456][ T371] __sys_connect+0x3cb/0x450 [ 28.990046][ T371] __x64_sys_connect+0x7a/0x90 [ 28.994805][ T371] x64_sys_call+0x7c/0x9a0 [ 28.999224][ T371] do_syscall_64+0x4c/0xa0 [ 29.003660][ T371] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 29.009580][ T371] [ 29.011903][ T371] Freed by task 371: [ 29.015791][ T371] kasan_set_track+0x4a/0x70 [ 29.020423][ T371] kasan_set_free_info+0x23/0x40 [ 29.025360][ T371] ____kasan_slab_free+0x125/0x160 [ 29.030470][ T371] __kasan_slab_free+0x11/0x20 [ 29.035230][ T371] slab_free_freelist_hook+0xc2/0x190 [ 29.040611][ T371] kfree+0xc4/0x270 [ 29.044425][ T371] l2tp_session_put+0xaf/0x1a0 [ 29.049200][ T371] l2tp_session_delete+0x3a9/0x4a0 [ 29.054319][ T371] pppol2tp_release+0x169/0x2b0 [ 29.059202][ T371] sock_close+0xb8/0x200 [ 29.063509][ T371] __fput+0x22b/0x900 [ 29.067528][ T371] ____fput+0x15/0x20 [ 29.071743][ T371] task_work_run+0x127/0x190 [ 29.076345][ T371] exit_to_user_mode_loop+0xd0/0xe0 [ 29.081548][ T371] exit_to_user_mode_prepare+0x87/0xd0 [ 29.087015][ T371] syscall_exit_to_user_mode+0x1a/0x30 [ 29.092482][ T371] do_syscall_64+0x58/0xa0 [ 29.096934][ T371] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 29.102833][ T371] [ 29.105173][ T371] The buggy address belongs to the object at ffff88812d6a0400 [ 29.105173][ T371] which belongs to the cache kmalloc-512 of size 512 [ 29.119235][ T371] The buggy address is located 336 bytes inside of [ 29.119235][ T371] 512-byte region [ffff88812d6a0400, ffff88812d6a0600) [ 29.132531][ T371] The buggy address belongs to the page: [ 29.138180][ T371] page:ffffea0004b5a800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12d6a0 [ 29.148420][ T371] head:ffffea0004b5a800 order:2 compound_mapcount:0 compound_pincount:0 [ 29.156740][ T371] flags: 0x4000000000010200(slab|head|zone=1) [ 29.162834][ T371] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 29.171434][ T371] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 29.180013][ T371] page dumped because: kasan: bad access detected [ 29.186421][ T371] page_owner tracks the page as allocated [ 29.192147][ T371] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 370, ts 28695330044, free_ts 0 [ 29.209596][ T371] post_alloc_hook+0x192/0x1b0 [ 29.214364][ T371] prep_new_page+0x1c/0x110 [ 29.218877][ T371] get_page_from_freelist+0x2c3a/0x2cd0 [ 29.224449][ T371] __alloc_pages+0x1a2/0x460 [ 29.229088][ T371] new_slab+0xa0/0x4d0 [ 29.233341][ T371] ___slab_alloc+0x3ac/0x840 [ 29.237937][ T371] __slab_alloc+0x49/0x90 [ 29.242285][ T371] __kmalloc+0x16a/0x2c0 [ 29.246543][ T371] ___neigh_create+0x6fb/0x1c50 [ 29.251438][ T371] __neigh_create+0x31/0x40 [ 29.255943][ T371] ip6_finish_output2+0xae3/0x1790 [ 29.261080][ T371] __ip6_finish_output+0x621/0x7e0 [ 29.266194][ T371] ip6_finish_output+0x31/0x220 [ 29.271051][ T371] ip6_output+0x1fa/0x410 [ 29.275382][ T371] ndisc_send_skb+0x7f6/0xcf0 [ 29.280058][ T371] ndisc_send_ns+0x879/0xb10 [ 29.284646][ T371] page_owner free stack trace missing [ 29.290013][ T371] [ 29.292330][ T371] Memory state around the buggy address: [ 29.297960][ T371] ffff88812d6a0400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.306017][ T371] ffff88812d6a0480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.314085][ T371] >ffff88812d6a0500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.322159][ T371] ^ [ 29.328831][ T371] ffff88812d6a0580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.336893][ T371] ffff88812d6a0600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.344980][ T371] ================================================================== [ 29.353032][ T371] Disabling lock debugging due to kernel taint