KASAN: slab-use-after-free Read in dummy_timer

Status: upstream: reported on 2026/08/22 02:22
Subsystems: usb
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+ba7702afee9d7d1375f0@syzkaller.appspotmail.com
First crash: 54d, last: 5d10h
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
6f4822ba repro-c 💥 KASAN: slab-use-after-free Read in dummy_timer 2026/09/14 21:05 2026/09/14 21:05 2026/09/15 01:54 81a27d1a
f96ea831 repro-c 💥 KASAN: slab-use-after-free Read in dummy_timer 2026/09/04 08:27 2026/09/04 09:41 2026/09/04 11:41 801f0966
7b4f7c87 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KASAN: slab-use-after-free Read in dummy_timer 2026/08/20 00:01 2026/08/20 00:01 2026/08/20 01:08 1e72964b
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [usb?] KASAN: slab-use-after-free Read in dummy_timer 0 (1) 2026/08/22 02:22
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in dummy_timer (2) prio:high usb 19 syz, C 97 55d 686d 29/29 fixed on 2026/08/17 15:57
linux-6.6 KASAN: slab-use-after-free Read in dummy_timer origin:upstream 19 syz, C error 12 32d 465d 0/2 upstream: reported C repro on 2025/07/02 21:23
linux-5.15 KASAN: use-after-free Read in dummy_timer 19 2 413d 503d 0/3 auto-obsoleted due to no activity on 2025/12/02 15:39
upstream general protection fault in dummy_timer usb 2 2 1060d 1106d 0/29 auto-obsoleted due to no activity on 2024/02/14 16:35
linux-5.15 KASAN: use-after-free Read in dummy_timer (2) 19 2 247d 251d 0/3 auto-obsoleted due to no activity on 2026/05/16 23:24

Sample crash report:
==================================================================
BUG: KASAN: slab-use-after-free in find_endpoint drivers/usb/gadget/udc/dummy_hcd.c:1622 [inline]
BUG: KASAN: slab-use-after-free in dummy_timer+0xce5/0x4cc0 drivers/usb/gadget/udc/dummy_hcd.c:1894
Read of size 1 at addr ffff888055626ce8 by task kworker/0:15/16108

CPU: 0 UID: 0 PID: 16108 Comm: kworker/0:15 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <IRQ>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 find_endpoint drivers/usb/gadget/udc/dummy_hcd.c:1622 [inline]
 dummy_timer+0xce5/0x4cc0 drivers/usb/gadget/udc/dummy_hcd.c:1894
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0x1e3/0x2e0 kernel/time/hrtimer.c:2148
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:221
Code: f7 e8 3d ff b9 f5 f7 c3 00 02 00 00 74 05 e8 e0 4b e6 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 74 fc aa f5 65 48 8b 05 0c 90 ab 07 48 85 c0 74 18 5b 41 5e e9
RSP: 0018:ffffc90002566c88 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000246 RCX: 8000000000000001
RDX: 0000000000000006 RSI: ffffffff8e4172d0 RDI: 0000000000000001
RBP: 00000000ffffffa6 R08: ffffffff907a657f R09: 1ffffffff20f4caf
R10: dffffc0000000000 R11: fffffbfff20f4cb0 R12: ffff88805859f028
R13: ffff88805859f14c R14: ffff88805859f108 R15: dffffc0000000000
 spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
 class_spinlock_irqsave_destructor include/linux/spinlock.h:644 [inline]
 xpad_inquiry_pad_presence drivers/input/joystick/xpad.c:1484 [inline]
 xpad360w_start_input+0x1c9/0x300 drivers/input/joystick/xpad.c:1870
 xpad_probe+0x17ce/0x2020 drivers/input/joystick/xpad.c:2202
 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_set_configuration+0x1bb5/0x2260 drivers/usb/core/message.c:2274
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3776
 usb_new_device+0x9aa/0x1690 drivers/usb/core/hub.c:2713
 hub_port_connect drivers/usb/core/hub.c:5585 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5725 [inline]
 port_event drivers/usb/core/hub.c:5889 [inline]
 hub_event+0x28e8/0x4d30 drivers/usb/core/hub.c:5971
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 19531:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_noprof+0x36b/0x720 mm/slub.c:5439
 _kmalloc_noprof include/linux/slab.h:995 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 hash_ipportnet6_add+0x2608/0x3290 net/netfilter/ipset/ip_set_hash_gen.h:1093
 hash_ipportnet6_uadt+0xa57/0xde0 net/netfilter/ipset/ip_set_hash_ipportnet.c:507
 call_ad+0x365/0xb50 net/netfilter/ipset/ip_set_core.c:1771
 ip_set_ad+0x82a/0x9d0 net/netfilter/ipset/ip_set_core.c:1861
 nfnetlink_rcv_msg+0xcc2/0x12b0 net/netfilter/nfnetlink.c:300
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2575
 nfnetlink_rcv+0x2b9/0x28c0 net/netfilter/nfnetlink.c:667
 netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1364
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
 __sock_sendmsg net/socket.c:815 [inline]
 ____sys_sendmsg+0x54e/0x850 net/socket.c:2713
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767
 __sys_sendmsg net/socket.c:2799 [inline]
 __do_sys_sendmsg net/socket.c:2804 [inline]
 __se_sys_sendmsg net/socket.c:2802 [inline]
 __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2802
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 19531:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6509 [inline]
 kfree+0x1c5/0x650 mm/slub.c:6802
 hash_ipportnet6_ahash_destroy net/netfilter/ipset/ip_set_hash_gen.h:569 [inline]
 hash_ipportnet6_resize+0x1cbf/0x1f60 net/netfilter/ipset/ip_set_hash_gen.h:915
 call_ad+0x43f/0xb50 net/netfilter/ipset/ip_set_core.c:1777
 ip_set_ad+0x82a/0x9d0 net/netfilter/ipset/ip_set_core.c:1861
 nfnetlink_rcv_msg+0xcc2/0x12b0 net/netfilter/nfnetlink.c:300
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2575
 nfnetlink_rcv+0x2b9/0x28c0 net/netfilter/nfnetlink.c:667
 netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1364
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
 __sock_sendmsg net/socket.c:815 [inline]
 ____sys_sendmsg+0x54e/0x850 net/socket.c:2713
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767
 __sys_sendmsg net/socket.c:2799 [inline]
 __do_sys_sendmsg net/socket.c:2804 [inline]
 __se_sys_sendmsg net/socket.c:2802 [inline]
 __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2802
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888055626c00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 232 bytes inside of
 freed 512-byte region [ffff888055626c00, ffff888055626e00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x55624
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7324, tgid 7324 (udevd), ts 194392073331
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab+0x7d/0x620 mm/slub.c:3462
 new_slab mm/slub.c:3513 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7418
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __kmalloc_cache_noprof+0x39b/0x600 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 kernfs_fop_open+0x3ac/0xce0 fs/kernfs/file.c:634
 do_dentry_open+0x816/0x1380 fs/open.c:996
 vfs_open+0x3b/0x340 fs/open.c:1101
 do_open fs/namei.c:4837 [inline]
 path_openat+0x1443/0x1d60 fs/namei.c:5000
 do_file_open+0x23e/0x4a0 fs/namei.c:5029
 do_sys_openat2+0x115/0x200 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1434
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 7324 tgid 7324 ts 194313565843 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962
 __slab_free+0x274/0x2c0 mm/slub.c:5823
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:361
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 __do_kmalloc_node mm/slub.c:5413 [inline]
 __kvmalloc_node_noprof+0x49f/0x820 mm/slub.c:7015
 seq_buf_alloc fs/seq_file.c:39 [inline]
 seq_read_iter+0x1ea/0xca0 fs/seq_file.c:211
 new_sync_read fs/read_write.c:493 [inline]
 vfs_read+0x595/0xa80 fs/read_write.c:574
 ksys_read+0x150/0x270 fs/read_write.c:716
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888055626b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888055626c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888055626c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                          ^
 ffff888055626d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888055626d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	f7 e8                	imul   %eax
   2:	3d ff b9 f5 f7       	cmp    $0xf7f5b9ff,%eax
   7:	c3                   	ret
   8:	00 02                	add    %al,(%rdx)
   a:	00 00                	add    %al,(%rax)
   c:	74 05                	je     0x13
   e:	e8 e0 4b e6 f5       	call   0xf5e64bf3
  13:	9c                   	pushf
  14:	58                   	pop    %rax
  15:	a9 00 02 00 00       	test   $0x200,%eax
  1a:	75 29                	jne    0x45
  1c:	f7 c3 00 02 00 00    	test   $0x200,%ebx
  22:	74 01                	je     0x25
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 74 fc aa f5       	call   0xf5aafca3 <-- trapping instruction
  2f:	65 48 8b 05 0c 90 ab 	mov    %gs:0x7ab900c(%rip),%rax        # 0x7ab9043
  36:	07
  37:	48 85 c0             	test   %rax,%rax
  3a:	74 18                	je     0x54
  3c:	5b                   	pop    %rbx
  3d:	41 5e                	pop    %r14
  3f:	e9                   	.byte 0xe9

Crashes (39):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/06 09:41 upstream 2c3418fffa9d f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/10/06 09:41 upstream 2c3418fffa9d f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/09/19 00:21 upstream c3d85c669d09 8d7d05f1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in dummy_timer
2026/09/15 17:27 upstream 587858367581 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/09/12 10:00 upstream 5225b8eec4c9 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in dummy_timer
2026/09/09 06:10 upstream 893e11787f78 8387c273 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/09/02 14:26 upstream 89a312991dc6 85995287 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/09/01 22:49 upstream 786262be6048 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in dummy_timer
2026/08/31 14:16 upstream cee9395acd80 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/08/31 13:42 upstream cee9395acd80 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Read in dummy_timer
2026/08/30 20:04 upstream 08dbfad3f504 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/08/28 09:20 upstream 1b78070aaef6 e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/08/28 08:58 upstream 1b78070aaef6 e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/08/27 12:34 upstream 73e3f0710014 a2b77b9e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/10/05 04:29 linux-next f0406245cb98 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/10/05 04:26 linux-next f0406245cb98 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/10/05 04:21 linux-next f0406245cb98 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/09/26 09:49 linux-next f5f84daefcd9 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/09/19 18:20 linux-next 9d80aa4617b3 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/09/14 14:23 linux-next 9d80aa4617b3 924033e8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/09/09 20:45 linux-next 9d80aa4617b3 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/09/05 23:35 linux-next 9d80aa4617b3 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/08/31 10:29 linux-next e30626823a40 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/08/31 10:28 linux-next e30626823a40 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/08/31 02:30 linux-next e30626823a40 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/08/31 00:06 linux-next e30626823a40 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/08/21 14:22 linux-next 7079a12d7506 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/08/20 23:56 linux-next 7079a12d7506 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/08/20 21:05 linux-next 7079a12d7506 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/08/20 18:28 linux-next 7079a12d7506 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/08/20 17:53 linux-next 7079a12d7506 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/08/20 17:47 linux-next 7079a12d7506 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/08/20 17:38 linux-next 7079a12d7506 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/08/20 17:37 linux-next 7079a12d7506 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/08/20 17:37 linux-next 7079a12d7506 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce KASAN: slab-use-after-free Read in dummy_timer
2026/08/18 02:14 linux-next e6664f2b33db 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-use-after-free Read in dummy_timer
2026/09/12 10:10 upstream 5225b8eec4c9 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-out-of-bounds Read in dummy_timer
2026/08/25 13:23 upstream 66498c75b4f8 614e416a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: use-after-free Read in dummy_timer
2026/08/23 09:39 linux-next 903c1cf6dff9 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root KASAN: slab-out-of-bounds Read in dummy_timer
* Struck through repros no longer work on HEAD.