kernel BUG in net_dm_packet_work (2)

Status: upstream: reported on 2026/09/11 11:45
Subsystems: net
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+586af68eb819833c2d91@syzkaller.appspotmail.com
Fix commit: a5117e1eccac net: skbuff: do not leave stale header offsets after pskb_carve()
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root]
First crash: 35d, last: 14d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
c3d02213 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ✅ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ kernel BUG in net_dm_packet_work (2) 2026/09/13 00:41 2026/09/13 00:41 2026/09/13 01:55 70a60e12
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH v2 net] net: skbuff: do not leave stale header offsets after pskb_carve() 5 (5) 2026/09/17 14:10
[PATCH net] net: skbuff: do not leave stale header offsets after pskb_carve() 8 (8) 2026/09/15 12:55
[syzbot] [net?] kernel BUG in net_dm_packet_work (2) 0 (1) 2026/09/11 11:45
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in net_dm_packet_work net -1 1 278d 278d 0/29 auto-obsoleted due to no activity on 2026/04/19 06:56

Sample crash report:
skb frag:     000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
skb frag:     000000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
skb frag:     00000100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
skb frag:     00000110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
skb frag:     00000120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
------------[ cut here ]------------
kernel BUG at ./include/linux/skbuff.h:2830!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 5708 Comm: kworker/0:5 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events net_dm_packet_work
RIP: 0010:__skb_pull include/linux/skbuff.h:2830 [inline]
RIP: 0010:skb_pull_inline include/linux/skbuff.h:2837 [inline]
RIP: 0010:skb_pull+0x1c4/0x1d0 net/core/skbuff.c:2677
Code: b7 11 f9 8b 44 24 04 89 43 70 48 c7 c7 60 88 71 8c 89 ee e8 7e 6b 06 f8 48 c7 c7 a0 88 71 8c 48 89 de 31 d2 e8 ad fb fe ff 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900062f7800 EFLAGS: 00010282
RAX: ffffffff89200950 RBX: ffff88806c8e0000 RCX: ffff888025da1f40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00000000000000fe R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed10170c490b R12: 000000000000401d
R13: dffffc0000000000 R14: 1ffff1100d91c00e R15: 0000000000003f1f
FS:  0000000000000000(0000) GS:ffff888125bc3000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31e0fff8 CR3: 0000000060ece000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 net_dm_packet_report net/core/drop_monitor.c:699 [inline]
 net_dm_packet_work+0x52c/0x14b0 net/core/drop_monitor.c:738
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__skb_pull include/linux/skbuff.h:2830 [inline]
RIP: 0010:skb_pull_inline include/linux/skbuff.h:2837 [inline]
RIP: 0010:skb_pull+0x1c4/0x1d0 net/core/skbuff.c:2677
Code: b7 11 f9 8b 44 24 04 89 43 70 48 c7 c7 60 88 71 8c 89 ee e8 7e 6b 06 f8 48 c7 c7 a0 88 71 8c 48 89 de 31 d2 e8 ad fb fe ff 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900062f7800 EFLAGS: 00010282
RAX: ffffffff89200950 RBX: ffff88806c8e0000 RCX: ffff888025da1f40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00000000000000fe R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed10170c490b R12: 000000000000401d
R13: dffffc0000000000 R14: 1ffff1100d91c00e R15: 0000000000003f1f
FS:  0000000000000000(0000) GS:ffff888125bc3000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055759558dee8 CR3: 000000002cfb0000 CR4: 00000000003526f0

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/01 23:53 upstream d24e8ac715de 6d32eb1f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root kernel BUG in net_dm_packet_work
2026/09/14 15:53 upstream 704340f1cd0d 924033e8 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream kernel BUG in net_dm_packet_work
2026/09/11 23:48 upstream 3026c6e4f223 70a60e12 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream kernel BUG in net_dm_packet_work
2026/09/11 06:42 upstream 08df884136f1 1fe56c0a .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream kernel BUG in net_dm_packet_work
* Struck through repros no longer work on HEAD.