syzkaller syzkaller login: [ 13.473021][ T28] kauditd_printk_skb: 48 callbacks suppressed [ 13.473034][ T28] audit: type=1400 audit(1768959034.335:59): avc: denied { transition } for pid=225 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.477657][ T28] audit: type=1400 audit(1768959034.335:60): avc: denied { noatsecure } for pid=225 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.480804][ T28] audit: type=1400 audit(1768959034.335:61): avc: denied { write } for pid=225 comm="sh" path="pipe:[14463]" dev="pipefs" ino=14463 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 13.484542][ T28] audit: type=1400 audit(1768959034.335:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.487470][ T28] audit: type=1400 audit(1768959034.335:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.124' (ED25519) to the list of known hosts. 2026/01/21 01:30:42 parsed 1 programs [ 22.102707][ T28] audit: type=1400 audit(1768959042.965:64): avc: denied { node_bind } for pid=283 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 22.123627][ T28] audit: type=1400 audit(1768959042.965:65): avc: denied { module_request } for pid=283 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 22.803396][ T28] audit: type=1400 audit(1768959043.665:66): avc: denied { mounton } for pid=289 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.804402][ T289] cgroup: Unknown subsys name 'net' [ 22.826083][ T28] audit: type=1400 audit(1768959043.665:67): avc: denied { mount } for pid=289 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.853352][ T28] audit: type=1400 audit(1768959043.695:68): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.853499][ T289] cgroup: Unknown subsys name 'devices' [ 22.993279][ T289] cgroup: Unknown subsys name 'hugetlb' [ 22.998900][ T289] cgroup: Unknown subsys name 'rlimit' [ 23.106917][ T28] audit: type=1400 audit(1768959043.965:69): avc: denied { setattr } for pid=289 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.130357][ T28] audit: type=1400 audit(1768959043.965:70): avc: denied { create } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.139036][ T292] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.150928][ T28] audit: type=1400 audit(1768959043.965:71): avc: denied { write } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.179620][ T28] audit: type=1400 audit(1768959043.965:72): avc: denied { read } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.199876][ T28] audit: type=1400 audit(1768959043.965:73): avc: denied { mounton } for pid=289 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.233386][ T289] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.842398][ T297] request_module fs-gadgetfs succeeded, but still no fs? [ 24.089347][ T319] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.096514][ T319] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.104022][ T319] device bridge_slave_0 entered promiscuous mode [ 24.110912][ T319] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.118014][ T319] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.125573][ T319] device bridge_slave_1 entered promiscuous mode [ 24.161263][ T319] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.168321][ T319] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.175594][ T319] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.182622][ T319] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.199546][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.207180][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.214568][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.224066][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.232279][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.239315][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.247713][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.256188][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.263323][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.275707][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.284759][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.297650][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.308306][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.316928][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.324827][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.333254][ T319] device veth0_vlan entered promiscuous mode [ 24.343895][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.352787][ T319] device veth1_macvtap entered promiscuous mode [ 24.361997][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.371407][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.404287][ T319] syz-executor (319) used greatest stack depth: 22016 bytes left 2026/01/21 01:30:45 executed programs: 0 [ 24.982366][ T43] device bridge_slave_1 left promiscuous mode [ 24.988800][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.996614][ T43] device bridge_slave_0 left promiscuous mode [ 25.002823][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.010548][ T43] device veth1_macvtap left promiscuous mode [ 25.016605][ T43] device veth0_vlan left promiscuous mode [ 25.107834][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.114930][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.123386][ T365] device bridge_slave_0 entered promiscuous mode [ 25.130416][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.137642][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.145087][ T365] device bridge_slave_1 entered promiscuous mode [ 25.190358][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.197814][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.206941][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.215470][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.223638][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.230641][ T318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.238203][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.255579][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.264193][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.272588][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.279616][ T318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.287113][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.295204][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.312714][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.323601][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.331986][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.339460][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.347887][ T365] device veth0_vlan entered promiscuous mode [ 25.357150][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.366348][ T365] device veth1_macvtap entered promiscuous mode [ 25.377088][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.386834][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.409221][ T376] incfs: Can't find or create .index dir in ./file0 [ 25.416144][ T376] incfs: mount failed -22 [ 25.421132][ T376] incfs: Can't find or create .incomplete dir in ./file0 [ 25.428515][ T376] incfs: mount failed -30 [ 25.439476][ T377] incfs: Can't find or create .incomplete dir in ./file0 [ 25.447165][ T377] incfs: mount failed -22 [ 25.452359][ T377] incfs: ino conflict with backing FS 2 [ 25.458109][ T377] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN [ 25.469808][ T377] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 25.478203][ T377] CPU: 1 PID: 377 Comm: syz.2.18 Not tainted syzkaller #0 [ 25.485293][ T377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 25.495338][ T377] RIP: 0010:mnt_want_write+0x2f/0x300 [ 25.500710][ T377] Code: 57 41 56 41 55 41 54 53 50 48 89 fb 49 bd 00 00 00 00 00 fc ff df e8 b0 2f aa ff 48 89 5d d0 4c 8d 73 08 4c 89 f3 48 c1 eb 03 <42> 80 3c 2b 00 74 08 4c 89 f7 e8 02 5c ef ff 4d 8b 3e 4d 8d a7 a8 [ 25.520290][ T377] RSP: 0018:ffffc90000967a68 EFLAGS: 00010202 [ 25.526544][ T377] RAX: ffffffff81c71a10 RBX: 0000000000000001 RCX: ffff8881151e3cc0 [ 25.534502][ T377] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.542455][ T377] RBP: ffffc90000967a98 R08: 0000000000000003 R09: 0000000000000004 [ 25.550418][ T377] R10: 0000000000000000 R11: fffff5200012cf2a R12: ffff8881150f1400 [ 25.558457][ T377] R13: dffffc0000000000 R14: 0000000000000008 R15: dffffc0000000000 [ 25.566407][ T377] FS: 000055555fe8a500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 25.575316][ T377] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.581879][ T377] CR2: 0000001b33863fff CR3: 000000012df29000 CR4: 00000000003506a0 [ 25.589828][ T377] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.597780][ T377] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.606280][ T377] Call Trace: [ 25.609627][ T377] [ 25.612635][ T377] ovl_want_write+0x92/0xa0 [ 25.617114][ T377] ovl_setattr+0x9a/0x540 [ 25.621422][ T377] ? __cfi_ovl_setattr+0x10/0x10 [ 25.626337][ T377] notify_change+0xcc3/0xf80 [ 25.630935][ T377] incfs_setattr+0x260/0x3e0 [ 25.635517][ T377] ? __cfi_incfs_setattr+0x10/0x10 [ 25.640614][ T377] notify_change+0xcc3/0xf80 [ 25.645222][ T377] chmod_common+0x223/0x3c0 [ 25.649709][ T377] ? __cfi_chmod_common+0x10/0x10 [ 25.654713][ T377] ? slab_free_freelist_hook+0xc2/0x190 [ 25.660250][ T377] ? user_path_at_empty+0x161/0x1c0 [ 25.665427][ T377] do_fchmodat+0xd4/0x1a0 [ 25.669826][ T377] ? __x64_sys_mount+0xd0/0xd0 [ 25.674572][ T377] ? do_faccessat+0xa20/0xa20 [ 25.679269][ T377] ? debug_smp_processor_id+0x17/0x20 [ 25.684617][ T377] __x64_sys_chmod+0x60/0x70 [ 25.689188][ T377] x64_sys_call+0x760/0x9a0 [ 25.693672][ T377] do_syscall_64+0x4c/0xa0 [ 25.698068][ T377] ? clear_bhb_loop+0x30/0x80 [ 25.702725][ T377] ? clear_bhb_loop+0x30/0x80 [ 25.707388][ T377] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.713264][ T377] RIP: 0033:0x7fc5e259acb9 [ 25.717661][ T377] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.737333][ T377] RSP: 002b:00007ffff9f5e8f8 EFLAGS: 00000246 ORIG_RAX: 000000000000005a [ 25.745735][ T377] RAX: ffffffffffffffda RBX: 00007fc5e2815fa0 RCX: 00007fc5e259acb9 [ 25.753700][ T377] RDX: 0000000000000000 RSI: 0000000000000054 RDI: 0000200000000000 [ 25.761662][ T377] RBP: 00007fc5e2608bf7 R08: 0000000000000000 R09: 0000000000000000 [ 25.769620][ T377] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.777581][ T377] R13: 00007fc5e2815fac R14: 00007fc5e2815fa0 R15: 00007fc5e2815fa0 [ 25.785542][ T377] [ 25.788540][ T377] Modules linked in: [ 25.793359][ T377] ---[ end trace 0000000000000000 ]--- [ 25.798823][ T377] RIP: 0010:mnt_want_write+0x2f/0x300 [ 25.804449][ T377] Code: 57 41 56 41 55 41 54 53 50 48 89 fb 49 bd 00 00 00 00 00 fc ff df e8 b0 2f aa ff 48 89 5d d0 4c 8d 73 08 4c 89 f3 48 c1 eb 03 <42> 80 3c 2b 00 74 08 4c 89 f7 e8 02 5c ef ff 4d 8b 3e 4d 8d a7 a8 [ 25.824250][ T377] RSP: 0018:ffffc90000967a68 EFLAGS: 00010202 [ 25.830322][ T377] RAX: ffffffff81c71a10 RBX: 0000000000000001 RCX: ffff8881151e3cc0 [ 25.838314][ T377] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.846322][ T377] RBP: ffffc90000967a98 R08: 0000000000000003 R09: 0000000000000004 [ 25.854308][ T377] R10: 0000000000000000 R11: fffff5200012cf2a R12: ffff8881150f1400 [ 25.862297][ T377] R13: dffffc0000000000 R14: 0000000000000008 R15: dffffc0000000000 [ 25.870254][ T377] FS: 000055555fe8a500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 25.879389][ T377] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.886175][ T377] CR2: 000000c007056000 CR3: 000000012df29000 CR4: 00000000003506b0 [ 25.894381][ T377] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.902372][ T377] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.910336][ T377] Kernel panic - not syncing: Fatal exception [ 25.916655][ T377] Kernel Offset: disabled [ 25.920961][ T377] Rebooting in 86400 seconds..