BUG: unable to handle kernel paging request in kernfs_rename_ns

Status: upstream: reported on 2026/04/10 04:04
Subsystems: kernfs
[Documentation on labels]
Reported-by: syzbot+1b3f7588ae20f386bc79@syzkaller.appspotmail.com
First crash: 255d, last: 3d09h
▶ ▼ ✨ AI Jobs (6)
ID Workflow Result Correct Bug Created Started Finished Revision Error
cd3c0577 assessment-security 💥 BUG: unable to handle kernel paging request in kernfs_rename_ns 2026/07/05 08:48 2026/07/05 08:48 2026/07/05 08:49 93f57954 
failed to run ["git" "-c" "core.hooksPath=/dev/null" "fetch" "--force" "--tags" "433dfd5a8a5d80bbf0669b14e9ed908911a52dd6" "db9030a787e327b80583582aa8114a37c4c35d38"]: exit status 128
fatal: remote er...
truncated to first 200 bytes; open job for full error
371ce64d assessment-security 💥 BUG: unable to handle kernel paging request in kernfs_rename_ns 2026/06/18 08:23 2026/06/18 08:23 2026/06/18 08:23 b62b3ded 
failed to run ["git" "-c" "core.hooksPath=/dev/null" "fetch" "--force" "--tags" "433dfd5a8a5d80bbf0669b14e9ed908911a52dd6" "db9030a787e327b80583582aa8114a37c4c35d38"]: exit status 128
fatal: remote er...
truncated to first 200 bytes; open job for full error
2ab95181 assessment-security 💥 BUG: unable to handle kernel paging request in kernfs_rename_ns 2026/06/10 04:02 2026/06/10 04:02 2026/06/10 04:02 c36c07f6 
failed to run ["git" "-c" "core.hooksPath=/dev/null" "fetch" "--force" "--tags" "433dfd5a8a5d80bbf0669b14e9ed908911a52dd6" "db9030a787e327b80583582aa8114a37c4c35d38"]: exit status 128
fatal: remote er...
truncated to first 200 bytes; open job for full error
0d972b2d assessment-security 💥 BUG: unable to handle kernel paging request in kernfs_rename_ns 2026/06/04 07:21 2026/06/04 07:21 2026/06/04 07:21 62fe1528 
failed to run ["git" "-c" "core.hooksPath=/dev/null" "fetch" "--force" "--tags" "433dfd5a8a5d80bbf0669b14e9ed908911a52dd6" "db9030a787e327b80583582aa8114a37c4c35d38"]: exit status 128
fatal: remote er...
truncated to first 200 bytes; open job for full error
10e97966 assessment-security 💥 BUG: unable to handle kernel paging request in kernfs_rename_ns 2026/06/02 04:13 2026/06/02 04:13 2026/06/02 04:13 386cc6da 
failed to run ["git" "-c" "core.hooksPath=/dev/null" "fetch" "--force" "--tags" "433dfd5a8a5d80bbf0669b14e9ed908911a52dd6" "db9030a787e327b80583582aa8114a37c4c35d38"]: exit status 128
fatal: remote er...
truncated to first 200 bytes; open job for full error
7ec8b192 assessment-security 💥 BUG: unable to handle kernel paging request in kernfs_rename_ns 2026/05/21 20:27 2026/05/21 20:27 2026/05/21 20:27 d5742584 
failed to run ["git" "-c" "core.hooksPath=/dev/null" "fetch" "--force" "--tags" "433dfd5a8a5d80bbf0669b14e9ed908911a52dd6" "db9030a787e327b80583582aa8114a37c4c35d38"]: exit status 128
fatal: remote er...
truncated to first 200 bytes; open job for full error
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [kernfs?] BUG: unable to handle kernel paging request in kernfs_rename_ns 0 (1) 2026/04/10 04:04
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in kernfs_rename_ns kernfs 2 6 419d 433d 0/29 auto-obsoleted due to no activity on 2025/09/11 01:22

Sample crash report:
Bluetooth: hci4: Opcode 0x0406 failed: -4
Bluetooth: hci4: Opcode 0x0406 failed: -4
Bluetooth: hci1: Opcode 0x0c1a failed: -4
Bluetooth: hci1: Opcode 0x0406 failed: -4
Unable to handle kernel paging request at virtual address dfff800000000006
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000006] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 9363 Comm: syz.7.1079 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : kernfs_rename_ns+0x44/0x55c fs/kernfs/dir.c:1828
lr : kernfs_rename_ns+0x3c/0x55c fs/kernfs/dir.c:1821
sp : ffff800093016ed0
x29: ffff800093016ed0 x28: dfff800000000000 x27: ffff0000eea8803d
x26: dfff800000000000 x25: 0000000000000000 x24: ffff700012602dec
x23: ffff0000c2e0bf00 x22: dfff800000000000 x21: 0000000000000000
x20: 0000000000000000 x19: 0000000000000030 x18: 00000000ffffffff
x17: ffff80008a791000 x16: 0000000000000007 x15: ffff800080c96954
x14: ffff800080c96604 x13: 0000000000000002 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000080000 x9 : 0000000000080000
x8 : 0000000000000006 x7 : 3d444c4f5f485441 x6 : 5f48544150564544
x5 : ffff0000ca27f18c x4 : ffff800087b1be4c x3 : 0000000000000000
x2 : 0000000000000000 x1 : ffff0000cc6f0000 x0 : 0000000000000001
Call trace:
 kernfs_rename_ns+0x44/0x55c fs/kernfs/dir.c:1828 (P)
 sysfs_move_dir_ns+0xbc/0xd0 fs/sysfs/dir.c:126
 kobject_move+0x154/0x23c lib/kobject.c:569
 device_move+0xdc/0x5a4 drivers/base/core.c:4689
 hci_conn_del_sysfs+0xb4/0x194 net/bluetooth/hci_sysfs.c:75
 hci_conn_cleanup net/bluetooth/hci_conn.c:170 [inline]
 hci_conn_del+0x9d8/0xf44 net/bluetooth/hci_conn.c:1306
 hci_conn_failed+0x224/0x334 net/bluetooth/hci_conn.c:1409
 hci_abort_conn_sync+0x5a4/0x938 net/bluetooth/hci_sync.c:5841
 hci_disconnect_all_sync+0x1e0/0x390 net/bluetooth/hci_sync.c:5864
 hci_suspend_sync+0x324/0x88c net/bluetooth/hci_sync.c:6340
 hci_suspend_dev+0x214/0x444 net/bluetooth/hci_core.c:2812
 hci_suspend_notifier+0xe4/0x2b0 net/bluetooth/hci_core.c:2381
 notifier_call_chain+0x1a4/0x624 kernel/notifier.c:85
 notifier_call_chain_robust+0x54/0xc4 kernel/notifier.c:120
 blocking_notifier_call_chain_robust+0x74/0xa8 kernel/notifier.c:345
 pm_notifier_call_chain_robust+0x34/0x60 kernel/power/main.c:172
 snapshot_open+0x17c/0x270 kernel/power/user.c:77
 misc_open+0x2dc/0x338 drivers/char/misc.c:163
 chrdev_open+0x398/0x3e8 fs/char_dev.c:411
 do_dentry_open+0x5c4/0xfc0 fs/open.c:947
 vfs_open+0x44/0x2dc fs/open.c:1052
 do_open fs/namei.c:4700 [inline]
 path_openat+0x21fc/0x2a60 fs/namei.c:4863
 do_file_open+0x1c8/0x2e8 fs/namei.c:4892
 do_sys_openat2+0x114/0x1e8 fs/open.c:1368
 do_sys_open+0xb0/0xe0 fs/open.c:1374
 __do_sys_openat fs/open.c:1390 [inline]
 __se_sys_openat fs/open.c:1385 [inline]
 __arm64_sys_openat+0xa0/0xbc fs/open.c:1385
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
Code: f2fbfffc 97dd5bb5 9100c293 d343fe68 (387c6908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	f2fbfffc 	movk	x28, #0xdfff, lsl #48
   4:	97dd5bb5 	bl	0xffffffffff756ed8
   8:	9100c293 	add	x19, x20, #0x30
   c:	d343fe68 	lsr	x8, x19, #3
* 10:	387c6908 	ldrb	w8, [x8, x28] <-- trapping instruction

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/24 14:17 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci b66b0005b6ce 544adce9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in kernfs_rename_ns
2025/11/14 01:35 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci db9030a787e3 07e030de .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in kernfs_rename_ns
2026/06/02 15:55 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in kernfs_rename_ns
2026/05/05 09:53 upstream c7e4e4d5f7dc a898ba9c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in kernfs_rename_ns
2026/04/10 04:03 upstream 8b02520ec5f7 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in kernfs_rename_ns
2025/12/16 16:06 upstream 40fbbd64bba6 d1b870e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in kernfs_rename_ns
2026/05/03 08:26 upstream 66edb901bf87 a0d91488 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in kernfs_rename_ns
2026/02/03 02:42 upstream dee65f79364c d78927dd .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in kernfs_rename_ns
2025/12/18 17:23 upstream ea1013c15392 d1b870e1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in kernfs_rename_ns
* Struck through repros no longer work on HEAD.