KASAN: slab-use-after-free Read in xfrm

Based on kernel commit 05441d697f7f:

Root Cause Analysis

1. Vulnerability Overview

The bug is a slab use-after-free read triggered when dereferencing skb->dev->nd_net via dev_net(skb->dev) at net/xfrm/xfrm_input.c:469. The access occurs during IP-TFS (IP Traffic Flow Security, RFC 9347) packet reception initiated from timer/softirq context (iptfs_drop_timer).

2. Detailed Technical Mechanism

Deferring Packets in IP-TFS Without Device Refcounting:
- In net/xfrm/xfrm_iptfs.c, when an outer IP-TFS packet is received via iptfs_input(x, skb), out-of-order packets or packets undergoing fragmented reassembly are held across softirq/RCU boundaries:
  - Out-of-order packets are queued in xtfs->w_saved[index].skb via iptfs_input_reorder().
  - Incomplete fragmented payloads are queued in xtfs->ra_newskb.
- iptfs_input() then returns -EINPROGRESS to xfrm_input() (net/xfrm/xfrm_input.c:706).
- In xfrm_input(), asynchronous handling for crypto (x->type->input) takes a reference to the incoming netdevice with dev_hold(dev) and drops it on async resumption (encap_type == -1). However, for iptfs_input() returning -EINPROGRESS, no dev_hold(skb->dev) is taken, nor does IP-TFS track device references or register a netdevice notifier to purge its reorder and reassembly queues upon device unregistration.
Ingress net_device Destruction:
- When the receiving network device is unregistered (e.g., via rtnl_dellink as shown in the KASAN report's page-free trace), its refcount reaches zero because no reference was held by the queued IP-TFS sk_buffs.
- The device is cleaned up and freed (netdev_run_todo $\to$ kobject_put $\to$ device_release $\to$ __free_frozen_pages).
- The physical page is released back to the page allocator and can subsequently be reallocated (in this report, recycled into the skbuff_small_head SLUB cache).
- As a consequence, skb->dev in xtfs->w_saved (or xtfs->ra_newskb) becomes a dangling pointer to freed memory.
Drop Timer Expiry and Dangling Pointer Propagation:
- When the IP-TFS drop timer expires, iptfs_drop_timer() runs in softirq context (net/xfrm/xfrm_iptfs.c:1675).
- It collects packets from xtfs->w_saved via __reorder_drop(xtfs, &list) and processes them using iptfs_input_ordered(x, skb).
- In iptfs_input_ordered(), __input_process_payload(x, data, &skbseq, &sublist) either reuses the queued skb or allocates new inner skbs via iptfs_alloc_skb():
```
if (!l3resv) {
    /* xfrm_input resume needs dev and xfrm ext from tunnel pkt */
    skb->dev = tpl->dev;
    __skb_ext_copy(skb, tpl);
}
```
  This copies the stale tpl->dev pointer into all inner reconstructed skbs.
- __input_process_payload() then dispatches the inner packets by calling:
```
list_for_each_entry_safe(skb, next, sublist, list) {
    skb_list_del_init(skb);
    if (xfrm_input(skb, 0, 0, -2))
        kfree_skb(skb);
}
```
Crash in xfrm_input():
- At the beginning of xfrm_input(skb, 0, 0, -2) (net/xfrm/xfrm_input.c:469):
```
int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
{
    const struct xfrm_state_afinfo *afinfo;
    struct net *net = dev_net(skb->dev);
    struct net_device *dev = skb->dev;
```
- Before encap_type == -2 is even inspected to branch to resume_decapped, dev_net(skb->dev) is invoked.
- dev_net() reads skb->dev->nd_net at offset 264 (0x108) from skb->dev. Because skb->dev points to the freed net_device, this read triggers a slab use-after-free access.

3. Functions, Structs, and Files Involved

net/xfrm/xfrm_iptfs.c:
- iptfs_input(), iptfs_input_reorder(), __reorder_future_fits(): stores skb without taking a netdevice reference (dev_hold()) or invalidating skb->dev on device teardown.
- iptfs_alloc_skb(): propagates skb->dev = tpl->dev to newly extracted packets.
- iptfs_drop_timer(), iptfs_input_ordered(), __input_process_payload(): dequeues and resubmits the skbs to xfrm_input().
net/xfrm/xfrm_input.c:
- xfrm_input(): prematurely dereferences dev_net(skb->dev) at line 469 before checking encap_type == -2.
struct net_device (include/linux/netdevice.h):
- Field nd_net at byte offset 264 (0x108), read via read_pnet(&dev->nd_net).

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision
a34695b8	assessment-security	DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ✅ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	KASAN: slab-use-after-free Read in xfrm_input	2026/11/05 01:46	2026/11/05 01:46	2026/11/05 02:42	73438ed0

assessment-security

DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ✅ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌

❓

KASAN: slab-use-after-free Read in xfrm_input

2026/11/05 01:46

2026/11/05 02:42

73438ed0

================================================================== BUG: KASAN: slab-use-after-free in read_pnet include/net/net_namespace.h:427 [inline] BUG: KASAN: slab-use-after-free in dev_net include/linux/netdevice.h:2822 [inline] BUG: KASAN: slab-use-after-free in xfrm_input+0x5ae2/0x7750 net/xfrm/xfrm_input.c:469 Read of size 8 at addr ffff888055b24108 by task syz.0.472/7171 CPU: 0 UID: 0 PID: 7171 Comm: syz.0.472 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 read_pnet include/net/net_namespace.h:427 [inline] dev_net include/linux/netdevice.h:2822 [inline] xfrm_input+0x5ae2/0x7750 net/xfrm/xfrm_input.c:469 __input_process_payload.isra.0+0x147b/0x2290 net/xfrm/xfrm_iptfs.c:1198 iptfs_input_ordered+0x692/0x870 net/xfrm/xfrm_iptfs.c:1295 iptfs_drop_timer+0x4c7/0x710 net/xfrm/xfrm_iptfs.c:1707 __run_hrtimer kernel/time/hrtimer.c:2079 [inline] __hrtimer_run_queues+0x448/0x9a0 kernel/time/hrtimer.c:2136 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2153 handle_softirqs+0x216/0xa20 kernel/softirq.c:669 __do_softirq kernel/softirq.c:703 [inline] invoke_softirq kernel/softirq.c:542 [inline] __irq_exit_rcu+0x178/0x220 kernel/softirq.c:786 irq_exit_rcu+0x9/0x30 kernel/softirq.c:809 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:its_return_thunk+0x0/0x10 arch/x86/lib/retpoline.S:437 Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <c3> cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 e9 bb e1 85 f5 cc RSP: 0018:ffffc900052a6e88 EFLAGS: 00000246 RAX: 0000000000080000 RBX: ffff888061f6d2a8 RCX: ffffc90006561000 RDX: 0000000000080000 RSI: ffffffff81f9226a RDI: 0000000000000001 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff926a9d5f R11: 0000000000000000 R12: 0000000000000000 R13: ffffffff8d8225c0 R14: ffffffff9d10a300 R15: ffffffff8b228bd0 trace_timer_init include/trace/events/timer.h:33 [inline] debug_init kernel/time/timer.c:838 [inline] timer_init_key+0x26a/0x310 kernel/time/timer.c:881 sctp_transport_init net/sctp/transport.c:78 [inline] sctp_transport_new+0x54b/0x760 net/sctp/transport.c:99 sctp_assoc_add_peer+0x34b/0x1550 net/sctp/associola.c:627 sctp_process_param net/sctp/sm_make_chunk.c:2574 [inline] sctp_process_init+0x2738/0x2e50 net/sctp/sm_make_chunk.c:2400 sctp_cmd_process_init net/sctp/sm_sideeffect.c:719 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1406 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1211 [inline] sctp_do_sm+0x3ca8/0x5c30 net/sctp/sm_sideeffect.c:1182 sctp_assoc_bh_rcv+0x392/0x740 net/sctp/associola.c:1048 sctp_inq_push+0x25c/0x320 net/sctp/inqueue.c:91 sctp_backlog_rcv+0x169/0x590 net/sctp/input.c:331 sk_backlog_rcv include/net/sock.h:1194 [inline] __release_sock+0x39d/0x440 net/core/sock.c:3341 release_sock+0x1e5/0x280 net/core/sock.c:3940 sctp_wait_for_connect+0x1ff/0x750 net/sctp/socket.c:9468 sctp_sendmsg_to_asoc+0x17fd/0x1b60 net/sctp/socket.c:1931 sctp_sendmsg+0x1144/0x22e0 net/sctp/socket.c:2086 inet_sendmsg+0x11c/0x140 net/ipv4/af_inet.c:864 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:818 [inline] ____sys_sendmsg+0xa23/0xc30 net/socket.c:2715 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2769 __sys_sendmmsg+0x20c/0x440 net/socket.c:2858 __do_sys_sendmmsg net/socket.c:2885 [inline] __se_sys_sendmmsg net/socket.c:2882 [inline] __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2882 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7effc5f9fb19 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007effc6d8f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007effc6225fa0 RCX: 00007effc5f9fb19 RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000004 RBP: 00007effc6037b70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020000014 R11: 0000000000000246 R12: 0000000000000000 R13: 00007effc6226038 R14: 00007effc6225fa0 R15: 00007fffbea305e8 </TASK> Allocated by task 5769: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:351 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:377 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4720 [inline] slab_alloc_node mm/slub.c:5033 [inline] kmem_cache_alloc_node_noprof+0x282/0x6e0 mm/slub.c:5105 kmalloc_reserve+0x148/0x350 net/core/skbuff.c:616 __alloc_skb+0x185/0x710 net/core/skbuff.c:716 __pskb_copy_fclone+0xfa/0xf40 net/core/skbuff.c:2229 __pskb_copy include/linux/skbuff.h:1454 [inline] pskb_copy include/linux/skbuff.h:3863 [inline] nf_dup_ipv4+0x1a2/0x8b0 net/ipv4/netfilter/nf_dup_ipv4.c:64 tee_tg4+0x10c/0x170 net/netfilter/xt_TEE.c:42 ipt_do_table+0xc41/0x1b10 net/ipv4/netfilter/ip_tables.c:345 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline] nf_hook_slow+0xbf/0x220 net/netfilter/core.c:633 nf_hook include/linux/netfilter.h:280 [inline] __ip_local_out+0x541/0xb80 net/ipv4/ip_output.c:120 ip_local_out+0x2a/0x1f0 net/ipv4/ip_output.c:129 __ip_queue_xmit+0x876/0x1f50 net/ipv4/ip_output.c:533 __tcp_transmit_skb+0x34d9/0x4f00 net/ipv4/tcp_output.c:1772 __tcp_send_ack.part.0+0x4e4/0x940 net/ipv4/tcp_output.c:4577 __tcp_send_ack net/ipv4/tcp_output.c:4583 [inline] tcp_send_ack+0x84/0xa0 net/ipv4/tcp_output.c:4583 __tcp_ack_snd_check+0x210/0xa10 net/ipv4/tcp_input.c:6194 tcp_ack_snd_check net/ipv4/tcp_input.c:6248 [inline] tcp_ack_snd_check net/ipv4/tcp_input.c:6242 [inline] tcp_rcv_established+0xcf1/0x3900 net/ipv4/tcp_input.c:6744 tcp_v4_do_rcv+0xbc8/0x1270 net/ipv4/tcp_ipv4.c:1859 tcp_v4_rcv+0x2eb0/0x4810 net/ipv4/tcp_ipv4.c:2253 ip_protocol_deliver_rcu+0xba/0x4d0 net/ipv4/ip_input.c:207 ip_local_deliver_finish+0x3fb/0x6e0 net/ipv4/ip_input.c:241 NF_HOOK include/linux/netfilter.h:325 [inline] NF_HOOK include/linux/netfilter.h:319 [inline] ip_local_deliver+0x1a3/0x200 net/ipv4/ip_input.c:262 dst_input include/net/dst.h:481 [inline] ip_rcv_finish net/ipv4/ip_input.c:492 [inline] NF_HOOK include/linux/netfilter.h:325 [inline] NF_HOOK include/linux/netfilter.h:319 [inline] ip_rcv+0x33a/0x3c0 net/ipv4/ip_input.c:612 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6433 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6546 process_backlog+0x487/0x1600 net/core/dev.c:6897 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7966 napi_poll net/core/dev.c:8029 [inline] net_rx_action+0xa40/0xf20 net/core/dev.c:8186 handle_softirqs+0x216/0xa20 kernel/softirq.c:669 do_softirq kernel/softirq.c:569 [inline] do_softirq+0xaf/0xf0 kernel/softirq.c:556 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline] __dev_queue_xmit+0xa43/0x48d0 net/core/dev.c:5121 dev_queue_xmit include/linux/netdevice.h:3483 [inline] neigh_hh_output include/net/neighbour.h:538 [inline] neigh_output include/net/neighbour.h:552 [inline] ip_finish_output2+0xfa4/0x2740 net/ipv4/ip_output.c:236 __ip_finish_output.part.0+0x43b/0x6f0 net/ipv4/ip_output.c:314 __ip_finish_output net/ipv4/ip_output.c:302 [inline] ip_finish_output net/ipv4/ip_output.c:324 [inline] NF_HOOK_COND include/linux/netfilter.h:314 [inline] ip_output+0x392/0xc00 net/ipv4/ip_output.c:437 dst_output include/net/dst.h:471 [inline] ip_local_out+0x193/0x1f0 net/ipv4/ip_output.c:131 __ip_queue_xmit+0x876/0x1f50 net/ipv4/ip_output.c:533 __tcp_transmit_skb+0x34d9/0x4f00 net/ipv4/tcp_output.c:1772 tcp_transmit_skb net/ipv4/tcp_output.c:1790 [inline] tcp_write_xmit+0x1133/0x84a0 net/ipv4/tcp_output.c:3126 tcp_sendmsg_locked+0x396a/0x46b0 net/ipv4/tcp.c:1405 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1462 inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:864 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:818 [inline] sock_write_iter+0x4fd/0x5d0 net/socket.c:1269 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6af/0x1050 fs/read_write.c:687 ksys_write+0x1f8/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5769: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:264 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:296 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2780 [inline] slab_free mm/slub.c:6630 [inline] kfree+0x22b/0x6d0 mm/slub.c:6923 skb_kfree_head net/core/skbuff.c:1084 [inline] skb_free_head+0xb9/0x160 net/core/skbuff.c:1096 skb_release_data+0x698/0x860 net/core/skbuff.c:1124 skb_release_all net/core/skbuff.c:1188 [inline] __kfree_skb+0x4f/0x70 net/core/skbuff.c:1202 tcp_data_queue+0x1964/0x4fa0 net/ipv4/tcp_input.c:5655 tcp_rcv_established+0xb96/0x3900 net/ipv4/tcp_input.c:6741 tcp_v4_do_rcv+0xbc8/0x1270 net/ipv4/tcp_ipv4.c:1859 sk_backlog_rcv include/net/sock.h:1194 [inline] __release_sock+0x355/0x440 net/core/sock.c:3341 release_sock+0x1e5/0x280 net/core/sock.c:3940 tcp_sendmsg+0x38/0x50 net/ipv4/tcp.c:1463 inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:864 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:818 [inline] sock_write_iter+0x4fd/0x5d0 net/socket.c:1269 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6af/0x1050 fs/read_write.c:687 ksys_write+0x1f8/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888055b24000 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 264 bytes inside of freed 704-byte region [ffff888055b24000, ffff888055b242c0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x55b24 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff888100a82280 dead000000000100 dead000000000122 raw: 0000000000000000 0000000200130013 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff888100a82280 dead000000000100 dead000000000122 head: 0000000000000000 0000000200130013 00000000f5000000 0000000000000000 head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xf2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_MEMALLOC|__GFP_COMP|__GFP_NOMEMALLOC), pid 5192, tgid 5192 (udevd), ts 75284032832 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1856 prep_new_page mm/page_alloc.c:1864 [inline] get_page_from_freelist+0x1113/0x35e0 mm/page_alloc.c:3935 __alloc_frozen_pages_noprof+0x2bd/0x3280 mm/page_alloc.c:5444 alloc_slab_page mm/slub.c:3384 [inline] allocate_slab mm/slub.c:3499 [inline] new_slab+0xb1/0x6d0 mm/slub.c:3550 refill_objects+0xe3/0x410 mm/slub.c:7539 refill_sheaf mm/slub.c:2917 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4811 alloc_from_pcs mm/slub.c:4887 [inline] slab_alloc_node mm/slub.c:5021 [inline] kmem_cache_alloc_node_noprof+0x4ed/0x6e0 mm/slub.c:5105 kmalloc_reserve+0x148/0x350 net/core/skbuff.c:616 __alloc_skb+0x185/0x710 net/core/skbuff.c:716 __netdev_alloc_skb+0x7a/0x980 net/core/skbuff.c:778 netdev_alloc_skb include/linux/skbuff.h:3521 [inline] dev_alloc_skb include/linux/skbuff.h:3534 [inline] __ieee80211_beacon_get+0xba9/0x1f00 net/mac80211/tx.c:5947 ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:6069 ieee80211_beacon_get include/net/mac80211.h:5936 [inline] mac80211_hwsim_beacon_tx+0x4c8/0xa00 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2512 __iterate_interfaces+0x2e6/0x650 net/mac80211/util.c:775 ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:811 mac80211_hwsim_beacon+0xe5/0x2a0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2548 page last free pid 7136 tgid 7135 ts 74943132413 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1403 [inline] __free_frozen_pages+0x7b4/0x1110 mm/page_alloc.c:2954 device_release+0xd2/0x270 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x640 lib/kobject.c:737 netdev_run_todo+0xa36/0x1620 net/core/dev.c:12021 rtnl_unlock net/core/rtnetlink.c:157 [inline] rtnl_net_unlock include/linux/rtnetlink.h:139 [inline] rtnl_dellink+0x47e/0xb30 net/core/rtnetlink.c:3739 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7169 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2584 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0x668/0x950 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x9ac/0x10c0 net/netlink/af_netlink.c:1920 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:818 [inline] ____sys_sendmsg+0xa99/0xc30 net/socket.c:2715 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2769 __sys_sendmsg+0x160/0x210 net/socket.c:2801 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888055b24000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888055b24080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888055b24100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888055b24180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888055b24200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ---------------- Code disassembly (best guess): 0: cc int3 1: cc int3 2: cc int3 3: cc int3 4: cc int3 5: cc int3 6: cc int3 7: cc int3 8: cc int3 9: cc int3 a: cc int3 b: cc int3 c: cc int3 d: cc int3 e: cc int3 f: cc int3 10: cc int3 11: cc int3 12: cc int3 13: cc int3 14: cc int3 15: cc int3 16: cc int3 17: cc int3 18: cc int3 19: cc int3 1a: cc int3 1b: cc int3 1c: cc int3 1d: cc int3 1e: cc int3 1f: cc int3 20: cc int3 21: cc int3 22: cc int3 23: cc int3 24: cc int3 25: cc int3 26: cc int3 27: cc int3 28: cc int3 29: cc int3 * 2a: c3 ret <-- trapping instruction 2b: cc int3 2c: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) 33: 00 00 00 00 37: 0f 1f 00 nopl (%rax) 3a: e9 bb e1 85 f5 jmp 0xf585e1fa 3f: cc int3

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/11/05 01:46	upstream	05441d697f7f	2ee8459f	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream	KASAN: slab-use-after-free Read in xfrm_input

Crashes (1):

Assets (help?)