BUG: unable to handle kernel NULL pointer dereference in __kernel_read

Status: upstream: reported on 2026/10/11 21:38
Reported-by: syzbot+80ef033d168f5e80f36b@syzkaller.appspotmail.com
First crash: 6d03h, last: 6d03h

Sample crash report:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
  ESR = 0x0000000086000006
  EC = 0x21: IABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000114131000
[0000000000000000] pgd=080000010ff2a003, p4d=080000010ff2a003, pud=080000012df44003, pmd=0000000000000000
Internal error: Oops: 0000000086000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 6762 Comm: syz.5.500 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 62400805 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=-c)
pc : 0x0
lr : generic_file_read_iter+0x3f0/0x5ac mm/filemap.c:2918
sp : ffff8000228e7060
x29: ffff8000228e7160 x28: dfff800000000000 x27: ffff70000451ce10
x26: 0000000000000002 x25: ffff0000d07ed400 x24: 1ffff0000451ce50
x23: 0000000000022402 x22: ffff80001204f3d8 x21: 0000000000001000
x20: ffff8000228e7220 x19: ffff8000228e7270 x18: 0000000000000000
x17: 0000000000000000 x16: ffff800011bcac18 x15: 0000000000000000
x14: 0000000000000001 x13: 1fffe0001a6d7767 x12: 0000000000000000
x11: ff00800008a2823c x10: 0000000000000000 x9 : d073c9d34a98dc00
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800008a27814
x2 : 0000000000000000 x1 : ffff8000228e7270 x0 : ffff8000228e7220
Call trace:
 0x0
 __kernel_read+0x24c/0x5c0 fs/read_write.c:428
 integrity_kernel_read+0x9c/0xe4 security/integrity/iint.c:228
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:485 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:516 [inline]
 ima_calc_file_hash+0x918/0x1560 security/integrity/ima/ima_crypto.c:573
 ima_collect_measurement+0x410/0x950 security/integrity/ima/ima_api.c:293
 ima_update_xattr+0x154/0x49c security/integrity/ima/ima_appraise.c:624
 ima_check_last_writer security/integrity/ima/ima_main.c:175 [inline]
 ima_file_free+0x2b0/0x370 security/integrity/ima/ima_main.c:199
 __fput+0x140/0x7b0 fs/file_table.c:314
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1f4/0x280 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1151
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x9c/0x12c arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: bad PC value
---[ end trace 0000000000000000 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/11 21:37 linux-6.1.y a500ba24937a 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in __kernel_read
* Struck through repros no longer work on HEAD.