kernel BUG in rxrpc_destroy_all_connections (2)

Status: upstream: reported C repro on 2026/08/06 00:12
Subsystems: net afs
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+89001660f14fb7684c83@syzkaller.appspotmail.com
First crash: 52d, last: 50m
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
613bef23 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ kernel BUG in rxrpc_destroy_all_connections (2) 2026/08/03 00:00 2026/08/03 00:00 2026/08/03 00:53 e611ffe1
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [afs?] [net?] kernel BUG in rxrpc_destroy_all_connections (2) 0 (2) 2026/09/22 14:57
[syzbot] Monthly afs report (Aug 2026) 0 (1) 2026/08/17 12:32
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG at net/rxrpc/conn_object.c:LINE! (2) afs net -1 7 2053d 2115d 0/29 auto-closed as invalid on 2021/05/17 08:51
upstream kernel BUG in rxrpc_destroy_all_connections net afs -1 4 1832d 1885d 0/29 auto-closed as invalid on 2022/01/14 17:56

Sample crash report:
netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
bridge_slave_1: left allmulticast mode
bridge_slave_1: left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
rxrpc: Assertion failed
------------[ cut here ]------------
kernel BUG at net/rxrpc/conn_object.c:488!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 5766 Comm: kworker/u32:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:rxrpc_destroy_all_connections.cold+0x12/0x14 net/rxrpc/conn_object.c:488
Code: ff 90 0f 0b e8 39 99 99 00 48 c7 c7 60 6a 5d 8d e8 3d c0 af ff 90 0f 0b e8 25 99 99 00 48 c7 c7 60 6a 5d 8d e8 29 c0 af ff 90 <0f> 0b e8 11 99 99 00 49 63 d6 48 83 ce ff 48 c7 c7 40 f3 00 91 e8
RSP: 0018:ffffc90003f27970 EFLAGS: 00010286
RAX: 0000000000000017 RBX: ffff8880394c0000 RCX: 0000000000000000
RDX: 0000000000000017 RSI: ffffffff81ea1579 RDI: fffff520007e4f1f
RBP: ffff8880394c0064 R08: 0000000000000007 R09: 0000000000000000
R10: 8000000000000000 R11: 0000000000000001 R12: 1ffff920007e4f30
R13: ffff8880394c0078 R14: ffff8880394c0088 R15: ffff8880394c0088
FS:  0000000000000000(0000) GS:ffff8880d5d53000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a4b15ca000 CR3: 000000003c5bd000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 rxrpc_exit_net+0x7b/0xc0 net/rxrpc/net_ns.c:113
 ops_exit_list net/core/net_namespace.c:200 [inline]
 ops_undo_list+0x2ee/0xab0 net/core/net_namespace.c:253
 cleanup_net+0x499/0x920 net/core/net_namespace.c:706
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rxrpc_destroy_all_connections.cold+0x12/0x14 net/rxrpc/conn_object.c:488
Code: ff 90 0f 0b e8 39 99 99 00 48 c7 c7 60 6a 5d 8d e8 3d c0 af ff 90 0f 0b e8 25 99 99 00 48 c7 c7 60 6a 5d 8d e8 29 c0 af ff 90 <0f> 0b e8 11 99 99 00 49 63 d6 48 83 ce ff 48 c7 c7 40 f3 00 91 e8
RSP: 0018:ffffc90003f27970 EFLAGS: 00010286
RAX: 0000000000000017 RBX: ffff8880394c0000 RCX: 0000000000000000
RDX: 0000000000000017 RSI: ffffffff81ea1579 RDI: fffff520007e4f1f
RBP: ffff8880394c0064 R08: 0000000000000007 R09: 0000000000000000
R10: 8000000000000000 R11: 0000000000000001 R12: 1ffff920007e4f30
R13: ffff8880394c0078 R14: ffff8880394c0088 R15: ffff8880394c0088
FS:  0000000000000000(0000) GS:ffff8880d5d53000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a4b15ca000 CR3: 000000003c5bd000 CR4: 0000000000352ef0

Crashes (21):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/22 14:57 upstream f0100363d8c3 e12281bd .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream kernel BUG in rxrpc_destroy_all_connections
2026/09/23 06:20 upstream fe2ec83746e5 abce1216 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root kernel BUG in rxrpc_destroy_all_connections
2026/09/23 02:42 upstream c4e9f74da438 3e2106e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root kernel BUG in rxrpc_destroy_all_connections
2026/09/23 02:36 upstream c4e9f74da438 3e2106e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root kernel BUG in rxrpc_destroy_all_connections
2026/09/23 02:35 upstream c4e9f74da438 3e2106e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root kernel BUG in rxrpc_destroy_all_connections
2026/09/22 04:54 upstream f0100363d8c3 e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root kernel BUG in rxrpc_destroy_all_connections
2026/09/10 22:45 upstream 50d05c7c76c9 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root kernel BUG in rxrpc_destroy_all_connections
2026/08/31 19:56 upstream cee9395acd80 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root kernel BUG in rxrpc_destroy_all_connections
2026/08/26 04:16 upstream 73ae59e97596 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in rxrpc_destroy_all_connections
2026/08/05 04:42 upstream c21bb4193868 d4abbeac .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root kernel BUG in rxrpc_destroy_all_connections
2026/08/01 17:43 upstream 0131b508c0e2 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce kernel BUG in rxrpc_destroy_all_connections
2026/09/23 07:23 upstream fe2ec83746e5 abce1216 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream kernel BUG in rxrpc_destroy_all_connections
2026/09/23 02:52 upstream c4e9f74da438 3e2106e5 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream kernel BUG in rxrpc_destroy_all_connections
2026/09/22 05:56 upstream f0100363d8c3 e12281bd .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream kernel BUG in rxrpc_destroy_all_connections
2026/08/23 22:10 net 7cbfb180945c 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce kernel BUG in rxrpc_destroy_all_connections
2026/08/25 18:46 net-next 91ec20351349 614e416a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce kernel BUG in rxrpc_destroy_all_connections
2026/09/23 00:39 linux-next a8c591ed6b67 3e2106e5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root kernel BUG in rxrpc_destroy_all_connections
2026/08/29 08:29 linux-next e30626823a40 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root kernel BUG in rxrpc_destroy_all_connections
2026/08/07 20:28 linux-next cc2b5f627e8c e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce kernel BUG in rxrpc_destroy_all_connections
2026/08/06 02:22 linux-next cc2b5f627e8c cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce kernel BUG in rxrpc_destroy_all_connections
2026/08/02 13:52 linux-next cc2b5f627e8c e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce kernel BUG in rxrpc_destroy_all_connections
* Struck through repros no longer work on HEAD.