Warning: Permanently added '10.128.0.237' (ED25519) to the list of known hosts. 2026/07/27 10:19:27 parsed 1 programs 2026/07/27 10:19:27 serving rpc on tcp://44779 [ 23.564830][ T28] audit: type=1400 audit(1785147567.373:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 23.585676][ T28] audit: type=1400 audit(1785147567.373:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 24.329656][ T28] audit: type=1400 audit(1785147568.133:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.331391][ T301] cgroup: Unknown subsys name 'net' [ 24.352337][ T28] audit: type=1400 audit(1785147568.143:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.379571][ T28] audit: type=1400 audit(1785147568.173:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.379704][ T301] cgroup: Unknown subsys name 'devices' [ 24.522097][ T301] cgroup: Unknown subsys name 'hugetlb' [ 24.527811][ T301] cgroup: Unknown subsys name 'rlimit' [ 24.635350][ T28] audit: type=1400 audit(1785147568.443:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.658531][ T28] audit: type=1400 audit(1785147568.443:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.679052][ T28] audit: type=1400 audit(1785147568.443:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.688001][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.699380][ T28] audit: type=1400 audit(1785147568.443:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.728077][ T28] audit: type=1400 audit(1785147568.443:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.760868][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.387535][ T307] request_module fs-gadgetfs succeeded, but still no fs? [ 25.741976][ T330] syz-executor (330) used greatest stack depth: 21824 bytes left [ 25.799993][ T341] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.807082][ T341] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.814504][ T341] device bridge_slave_0 entered promiscuous mode [ 25.821357][ T341] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.828392][ T341] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.835843][ T341] device bridge_slave_1 entered promiscuous mode [ 25.872214][ T341] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.879256][ T341] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.886544][ T341] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.893581][ T341] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.910429][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.918019][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.925424][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.935124][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.943392][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.950434][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.958900][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.967224][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.974274][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.988684][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.996740][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.009415][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.019969][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.028204][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.035853][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.044602][ T341] device veth0_vlan entered promiscuous mode [ 26.054915][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.063854][ T341] device veth1_macvtap entered promiscuous mode [ 26.073062][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.082799][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.114703][ T341] syz-executor (341) used greatest stack depth: 21536 bytes left 2026/07/27 10:19:30 executed programs: 0 [ 26.429345][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.436538][ T368] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.443908][ T368] device bridge_slave_0 entered promiscuous mode [ 26.450818][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.457860][ T368] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.465308][ T368] device bridge_slave_1 entered promiscuous mode [ 26.506468][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.513529][ T368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.520846][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.527867][ T368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.550932][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.558536][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.566000][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.574884][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.583704][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.590764][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.602408][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.610701][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.617724][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.629047][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.638243][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.656726][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.667883][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.675966][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.683629][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.697750][ T368] device veth0_vlan entered promiscuous mode [ 26.707473][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.716520][ T368] device veth1_macvtap entered promiscuous mode [ 26.725353][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.733762][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.746044][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.754465][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.411500][ T8] device bridge_slave_1 left promiscuous mode [ 27.417672][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.425149][ T8] device bridge_slave_0 left promiscuous mode [ 27.431349][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.439157][ T8] device veth1_macvtap left promiscuous mode [ 27.445272][ T8] device veth0_vlan left promiscuous mode [ 27.650451][ C1] ================================================================== [ 27.658544][ C1] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 27.665924][ C1] Read of size 8 at addr ffff88812ddb3590 by task syz-execprog/295 [ 27.673794][ C1] [ 27.676131][ C1] CPU: 1 PID: 295 Comm: syz-execprog Not tainted syzkaller #0 [ 27.683590][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 27.693635][ C1] Call Trace: [ 27.696896][ C1] [ 27.699721][ C1] __dump_stack+0x21/0x24 [ 27.704057][ C1] dump_stack_lvl+0x110/0x170 [ 27.708715][ C1] ? __cfi_dump_stack_lvl+0x8/0x8 [ 27.713818][ C1] ? debug_smp_processor_id+0x17/0x20 [ 27.719185][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 27.724190][ C1] print_address_description+0x71/0x200 [ 27.729716][ C1] print_report+0x4a/0x60 [ 27.734021][ C1] kasan_report+0x122/0x150 [ 27.738504][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 27.743524][ C1] __asan_report_load8_noabort+0x14/0x20 [ 27.749153][ C1] rcu_cblist_dequeue+0x6c/0xb0 [ 27.754005][ C1] rcu_do_batch+0x4bc/0xc30 [ 27.758495][ C1] ? insert_work+0x26c/0x300 [ 27.763071][ C1] ? rcu_core+0xf00/0xf00 [ 27.767397][ C1] ? __kasan_check_write+0x14/0x20 [ 27.772486][ C1] ? _raw_spin_lock_irqsave+0xc2/0x130 [ 27.777927][ C1] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 27.783812][ C1] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 27.789598][ C1] ? rcu_report_qs_rnp+0x2b9/0x390 [ 27.794714][ C1] rcu_core+0x486/0xf00 [ 27.798846][ C1] ? rcu_cpu_kthread_park+0x90/0x90 [ 27.804020][ C1] ? kvm_sched_clock_read+0x18/0x40 [ 27.809204][ C1] rcu_core_si+0x9/0x10 [ 27.813342][ C1] handle_softirqs+0x1d7/0x600 [ 27.818101][ C1] __irq_exit_rcu+0x52/0xf0 [ 27.822584][ C1] irq_exit_rcu+0x9/0x10 [ 27.826805][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 27.832422][ C1] [ 27.835353][ C1] [ 27.838262][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 27.844246][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x55/0x80 [ 27.850646][ C1] Code: 80 db 0d 87 e8 7c f1 b5 fc 4c 89 f7 48 83 3d 01 dc 0c 02 00 74 30 e8 9e 0d 00 00 90 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 d6 96 4b fc 65 8b 05 27 6e 01 7b 85 c0 74 05 5b 41 5e 5d c3 e8 [ 27.870385][ C1] RSP: 0018:ffffc90000e17200 EFLAGS: 00000206 [ 27.876738][ C1] RAX: 0000000000000001 RBX: 0000000000000a06 RCX: dffffc0000000000 [ 27.884710][ C1] RDX: 0000000000000000 RSI: 0000000000000a06 RDI: 0000000000000001 [ 27.892938][ C1] RBP: ffffc90000e17210 R08: ffffea00049c9d47 R09: 1ffffd40009393a8 [ 27.900889][ C1] R10: dffffc0000000000 R11: fffff940009393a9 R12: ffffea00049c9d00 [ 27.908864][ C1] R13: ffff888100287550 R14: dffffc0000000000 R15: 0000000000000a00 [ 27.916831][ C1] release_pages+0x1f4/0xce0 [ 27.921403][ C1] ? __alloc_pages+0x1fa/0x610 [ 27.926146][ C1] ? cgroup_rstat_updated+0xf0/0x360 [ 27.931498][ C1] ? __cfi_release_pages+0x10/0x10 [ 27.936588][ C1] ? __kasan_check_read+0x11/0x20 [ 27.941587][ C1] free_pages_and_swap_cache+0x86/0xa0 [ 27.947028][ C1] tlb_flush_mmu+0x107/0x1f0 [ 27.951861][ C1] unmap_page_range+0x20ed/0x2360 [ 27.956882][ C1] ? __cfi_unmap_page_range+0x10/0x10 [ 27.962248][ C1] ? mas_find+0xdf/0x380 [ 27.966479][ C1] unmap_vmas+0x34c/0x480 [ 27.970804][ C1] ? __cfi_unmap_vmas+0x10/0x10 [ 27.975645][ C1] ? mas_next_slot+0x9d7/0xa10 [ 27.980392][ C1] ? __cfi_lru_add_drain_cpu+0x10/0x10 [ 27.985848][ C1] ? __kasan_check_write+0x14/0x20 [ 27.990975][ C1] exit_mmap+0x2a4/0xc10 [ 27.995226][ C1] ? perf_event_exit_event+0x530/0x530 [ 28.000672][ C1] ? __cfi_exit_mmap+0x10/0x10 [ 28.005420][ C1] ? _raw_spin_lock_irqsave+0xc2/0x130 [ 28.010870][ C1] ? __cfi_exit_aio+0x10/0x10 [ 28.015536][ C1] ? uprobe_clear_state+0x2c6/0x320 [ 28.020727][ C1] __mmput+0x92/0x340 [ 28.024708][ C1] mmput+0x4b/0x150 [ 28.028591][ C1] do_exit+0xa51/0x2850 [ 28.032738][ C1] ? __schedule+0xbea/0x14b0 [ 28.037316][ C1] ? __cfi_do_exit+0x10/0x10 [ 28.041895][ C1] ? plist_check_list+0x255/0x270 [ 28.046909][ C1] ? _raw_spin_lock+0x94/0xf0 [ 28.051574][ C1] ? __kasan_check_write+0x14/0x20 [ 28.056669][ C1] ? _raw_spin_lock_irq+0x95/0xf0 [ 28.061680][ C1] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 28.067213][ C1] do_group_exit+0x21b/0x2e0 [ 28.071794][ C1] ? __kasan_check_write+0x14/0x20 [ 28.076891][ C1] ? recalc_sigpending+0x168/0x1c0 [ 28.081992][ C1] get_signal+0x167c/0x1700 [ 28.086506][ C1] ? __cfi_get_signal+0x10/0x10 [ 28.091353][ C1] arch_do_signal_or_restart+0xd1/0x11c0 [ 28.096972][ C1] ? do_futex+0x2e2/0x430 [ 28.101284][ C1] ? percpu_counter_add_batch+0x13c/0x160 [ 28.106996][ C1] ? __cfi_do_futex+0x10/0x10 [ 28.111657][ C1] ? __fput+0x66d/0x8f0 [ 28.115801][ C1] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 28.121947][ C1] ? __se_sys_futex+0x136/0x310 [ 28.126783][ C1] ? fput+0x15b/0x1a0 [ 28.130755][ C1] exit_to_user_mode_loop+0x7a/0xb0 [ 28.135938][ C1] exit_to_user_mode_prepare+0x87/0xd0 [ 28.141385][ C1] syscall_exit_to_user_mode+0x1a/0x30 [ 28.146829][ C1] do_syscall_64+0x58/0xa0 [ 28.151230][ C1] ? clear_bhb_loop+0x30/0x80 [ 28.155889][ C1] ? clear_bhb_loop+0x30/0x80 [ 28.160549][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.166434][ C1] RIP: 0033:0x493e43 [ 28.170331][ C1] Code: Unable to access opcode bytes at 0x493e19. [ 28.176806][ C1] RSP: 002b:00007ffe6939d4b8 EFLAGS: 00000286 ORIG_RAX: 00000000000000ca [ 28.185203][ C1] RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 0000000000493e43 [ 28.193164][ C1] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000033de9b8 [ 28.201117][ C1] RBP: 00007ffe6939d500 R08: 0000000000000000 R09: 0000000000000000 [ 28.209073][ C1] R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffe6939d510 [ 28.217025][ C1] R13: 0000061971a4d700 R14: 00000000033dce20 R15: ffffffffffffffff [ 28.224988][ C1] [ 28.227990][ C1] [ 28.230294][ C1] Allocated by task 373: [ 28.234514][ C1] kasan_set_track+0x4b/0x70 [ 28.239101][ C1] kasan_save_alloc_info+0x1f/0x30 [ 28.244192][ C1] __kasan_kmalloc+0x95/0xb0 [ 28.248768][ C1] __kmalloc+0xb4/0x1e0 [ 28.252904][ C1] l2tp_session_create+0x38/0xbd0 [ 28.257912][ C1] pppol2tp_connect+0xbf5/0x1640 [ 28.262832][ C1] __sys_connect+0x3da/0x460 [ 28.267407][ C1] __x64_sys_connect+0x7a/0x90 [ 28.272154][ C1] x64_sys_call+0x88d/0x9a0 [ 28.276646][ C1] do_syscall_64+0x4c/0xa0 [ 28.281069][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.286951][ C1] [ 28.289273][ C1] Freed by task 43: [ 28.293056][ C1] kasan_set_track+0x4b/0x70 [ 28.297650][ C1] kasan_save_free_info+0x2b/0x40 [ 28.302665][ C1] ____kasan_slab_free+0x132/0x180 [ 28.307781][ C1] __kasan_slab_free+0x11/0x20 [ 28.312541][ C1] slab_free_freelist_hook+0xc2/0x190 [ 28.317906][ C1] __kmem_cache_free+0xb7/0x1b0 [ 28.322768][ C1] kfree+0x6f/0xf0 [ 28.326475][ C1] l2tp_session_put+0xaf/0x1a0 [ 28.331223][ C1] l2tp_session_delete+0x3df/0x4d0 [ 28.336325][ C1] l2tp_tunnel_del_work+0x199/0x410 [ 28.341513][ C1] process_one_work+0x717/0xc30 [ 28.346348][ C1] worker_thread+0xa4d/0x11d0 [ 28.351005][ C1] kthread+0x281/0x320 [ 28.355057][ C1] ret_from_fork+0x1f/0x30 [ 28.359488][ C1] [ 28.361800][ C1] Last potentially related work creation: [ 28.367492][ C1] kasan_save_stack+0x3a/0x60 [ 28.372158][ C1] __kasan_record_aux_stack+0xb6/0xc0 [ 28.377531][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 28.383356][ C1] call_rcu+0xcf/0xf50 [ 28.387431][ C1] pppol2tp_release+0x1e3/0x2b0 [ 28.392271][ C1] sock_close+0xc9/0x220 [ 28.396512][ C1] __fput+0x1fd/0x8f0 [ 28.400484][ C1] ____fput+0x15/0x20 [ 28.404458][ C1] task_work_run+0x1e1/0x250 [ 28.409033][ C1] exit_to_user_mode_loop+0x9b/0xb0 [ 28.414215][ C1] exit_to_user_mode_prepare+0x87/0xd0 [ 28.419658][ C1] syscall_exit_to_user_mode+0x1a/0x30 [ 28.425099][ C1] do_syscall_64+0x58/0xa0 [ 28.429499][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.435379][ C1] [ 28.437687][ C1] The buggy address belongs to the object at ffff88812ddb3400 [ 28.437687][ C1] which belongs to the cache kmalloc-512 of size 512 [ 28.451721][ C1] The buggy address is located 400 bytes inside of [ 28.451721][ C1] 512-byte region [ffff88812ddb3400, ffff88812ddb3600) [ 28.464979][ C1] [ 28.467286][ C1] The buggy address belongs to the physical page: [ 28.473686][ C1] page:ffffea0004b76c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12ddb0 [ 28.483925][ C1] head:ffffea0004b76c00 order:2 compound_mapcount:0 compound_pincount:0 [ 28.492237][ C1] flags: 0x4000000000010200(slab|head|zone=1) [ 28.498319][ C1] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 28.506898][ C1] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 28.515489][ C1] page dumped because: kasan: bad access detected [ 28.521883][ C1] page_owner tracks the page as allocated [ 28.527614][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 60, tgid 60 (kworker/0:2), ts 26770621983, free_ts 26253319300 [ 28.549331][ C1] post_alloc_hook+0x1f5/0x210 [ 28.554090][ C1] prep_new_page+0x1c/0x110 [ 28.558583][ C1] get_page_from_freelist+0x2ca9/0x2d20 [ 28.564116][ C1] __alloc_pages+0x1fa/0x610 [ 28.568694][ C1] alloc_slab_page+0x6e/0xf0 [ 28.573292][ C1] new_slab+0x98/0x3e0 [ 28.577344][ C1] ___slab_alloc+0x70f/0xb70 [ 28.581943][ C1] __slab_alloc+0x5e/0xa0 [ 28.586286][ C1] __kmem_cache_alloc_node+0x204/0x2d0 [ 28.591738][ C1] __kmalloc_node_track_caller+0xa1/0x1e0 [ 28.597440][ C1] __alloc_skb+0x226/0x4a0 [ 28.601862][ C1] ndisc_ns_create+0x26e/0x920 [ 28.606609][ C1] ndisc_send_ns+0xb7/0x160 [ 28.611181][ C1] addrconf_dad_work+0x9d6/0x14a0 [ 28.616190][ C1] process_one_work+0x717/0xc30 [ 28.621034][ C1] worker_thread+0xa4d/0x11d0 [ 28.625961][ C1] page last free stack trace: [ 28.630613][ C1] free_unref_page_prepare+0x80c/0x820 [ 28.636063][ C1] free_unref_page+0x93/0x530 [ 28.640727][ C1] __free_pages+0x67/0x100 [ 28.645129][ C1] __vunmap+0xa3c/0xc00 [ 28.649269][ C1] vfree+0x61/0x90 [ 28.652972][ C1] kcov_close+0x2b/0x50 [ 28.657112][ C1] __fput+0x1fd/0x8f0 [ 28.661084][ C1] ____fput+0x15/0x20 [ 28.665051][ C1] task_work_run+0x1e1/0x250 [ 28.669631][ C1] do_exit+0xaf2/0x2850 [ 28.673776][ C1] do_group_exit+0x21b/0x2e0 [ 28.678354][ C1] get_signal+0x167c/0x1700 [ 28.682848][ C1] arch_do_signal_or_restart+0xd1/0x11c0 [ 28.688468][ C1] exit_to_user_mode_loop+0x7a/0xb0 [ 28.693655][ C1] exit_to_user_mode_prepare+0x87/0xd0 [ 28.699100][ C1] syscall_exit_to_user_mode+0x1a/0x30 [ 28.704544][ C1] [ 28.706853][ C1] Memory state around the buggy address: [ 28.712493][ C1] ffff88812ddb3480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.720535][ C1] ffff88812ddb3500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.728577][ C1] >ffff88812ddb3580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.736616][ C1] ^ [ 28.741185][ C1] ffff88812ddb3600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.749223][ C1] ffff88812ddb3680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.757260][ C1] ================================================================== [ 28.765349][ C1] Disabling lock debugging due to kernel taint [ 28.778015][ T28] kauditd_printk_skb: 34 callbacks suppressed [ 28.778028][ T28] audit: type=1400 audit(1785147572.593:108): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1