KMSAN: kernel-infoleak in irqentry_exit (2)

Status: fixed on 2026/07/20 12:16
Subsystems: kernel
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+95096af594918ed6dcb8@syzkaller.appspotmail.com
Fix commit: 6d99479799c6 rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()
First crash: 8d11h, last: 3d08h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
bcc1a221-2365-4f1b-94a6-ed0636e07e09 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KMSAN: kernel-infoleak in irqentry_exit (2) 2026/07/17 00:44 2026/07/17 00:44 2026/07/17 01:25 49f47391518e9cfe0cedbef0d8259b0041150b4f

			
		
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [kernel?] KMSAN: kernel-infoleak in irqentry_exit (2) 0 (1) 2026/07/19 09:28
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: kernel-infoleak in irqentry_exit prio:high kernel 9 61732 8d12h 53d 29/29 fixed on 2026/07/15 08:27

Sample crash report:
8021q: adding VLAN 0 to HW filter on device bond0
eql: remember to turn off Van-Jacobson compression on your slave devices
=====================================================
BUG: KMSAN: kernel-infoleak in rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline]
BUG: KMSAN: kernel-infoleak in rseq_update_usr include/linux/rseq_entry.h:536 [inline]
BUG: KMSAN: kernel-infoleak in rseq_exit_user_update include/linux/rseq_entry.h:645 [inline]
BUG: KMSAN: kernel-infoleak in __rseq_exit_to_user_mode_restart include/linux/rseq_entry.h:674 [inline]
BUG: KMSAN: kernel-infoleak in rseq_exit_to_user_mode_restart include/linux/rseq_entry.h:703 [inline]
BUG: KMSAN: kernel-infoleak in exit_to_user_mode_loop kernel/entry/common.c:103 [inline]
BUG: KMSAN: kernel-infoleak in __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
BUG: KMSAN: kernel-infoleak in irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline]
BUG: KMSAN: kernel-infoleak in irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline]
BUG: KMSAN: kernel-infoleak in irqentry_exit+0x4a6/0xa40 kernel/entry/common.c:165
 rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline]
 rseq_update_usr include/linux/rseq_entry.h:536 [inline]
 rseq_exit_user_update include/linux/rseq_entry.h:645 [inline]
 __rseq_exit_to_user_mode_restart include/linux/rseq_entry.h:674 [inline]
 rseq_exit_to_user_mode_restart include/linux/rseq_entry.h:703 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:103 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline]
 irqentry_exit+0x4a6/0xa40 kernel/entry/common.c:165
 exc_page_fault+0x7e/0xb0 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:595

Local variable agg.tmp11.i.i.i created at:
 class_fd_constructor include/linux/file.h:83 [inline]
 __sys_getsockopt net/socket.c:2497 [inline]
 __do_sys_getsockopt net/socket.c:2512 [inline]
 __se_sys_getsockopt net/socket.c:2509 [inline]
 __x64_sys_getsockopt+0xdb/0x4f0 net/socket.c:2509
 x64_sys_call+0x3ab8/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:56

Bytes 1-3 of 4 are uninitialized
Memory access of size 4 starts at ffff8881173b3e78
Data copied to user address 00007f25e488a680

CPU: 0 UID: 0 PID: 5224 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
=====================================================

Crashes (11110):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/20 12:09 upstream 4a50a141f05a de6a700d .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 11:54 upstream 4a50a141f05a de6a700d .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 11:42 upstream 4a50a141f05a de6a700d .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 09:04 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 08:43 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 08:33 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 08:08 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 07:56 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 07:44 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 07:32 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 07:08 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 06:45 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 06:32 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 05:58 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 05:36 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 05:24 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 05:15 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 05:04 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 04:43 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 04:18 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 04:06 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 03:53 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 03:43 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 03:30 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 03:21 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 03:09 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 02:47 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 02:13 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 01:34 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/19 09:23 upstream 4a50a141f05a 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/17 00:40 upstream 4a50a141f05a 8f30cfd7 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/15 09:27 upstream 4a50a141f05a 209f0369 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 08:55 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 08:22 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 07:20 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 06:57 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 06:19 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 06:11 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 05:47 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 04:54 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 04:32 upstream a13c140cc289 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 02:57 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 02:35 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 02:23 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 02:00 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
2026/07/20 01:46 upstream a13c140cc289 72524a66 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: kernel-infoleak in irqentry_exit
* Struck through repros no longer work on HEAD.