KCSAN: data-race in wg_set_device_doit / wg_timers_any_authenticated_packet_traversal

Status: moderation: reported C repro on 2026/09/24 05:11
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+de9701a2cad597c14d34@syzkaller.appspotmail.com
First crash: 5h21m, last: 5h21m
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
84d45e5e assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ✅ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in wg_set_device_doit / wg_timers_any_authenticated_packet_traversal 2026/09/24 10:01 2026/09/24 10:01 2026/09/24 10:03 3c3cdf19
d7831def assessment-kcsan Benign: ✅ KCSAN: data-race in wg_set_device_doit / wg_timers_any_authenticated_packet_traversal 2026/09/24 09:26 2026/09/24 09:26 2026/09/24 10:00 3c3cdf19

Sample crash report:
==================================================================
BUG: KCSAN: data-race in wg_set_device_doit / wg_timers_any_authenticated_packet_traversal

write to 0xffff88810b9faabc of 2 bytes by task 3648 on cpu 1:
 set_peer drivers/net/wireguard/netlink.c:457 [inline]
 wg_set_device_doit+0xcfd/0x1300 drivers/net/wireguard/netlink.c:569
 genl_family_rcv_msg_doit+0x187/0x1f0 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x42f/0x470 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x11e/0x220 net/netlink/af_netlink.c:2575
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline]
 netlink_unicast+0x5a9/0x680 net/netlink/af_netlink.c:1364
 netlink_sendmsg+0x5be/0x6f0 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:815 [inline]
 __sys_sendto+0x411/0x470 net/socket.c:2281
 __do_sys_sendto net/socket.c:2288 [inline]
 __se_sys_sendto net/socket.c:2284 [inline]
 __x64_sys_sendto+0x76/0x90 net/socket.c:2284
 x64_sys_call+0x200c/0x2550 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810b9faabc of 2 bytes by task 3652 on cpu 0:
 wg_timers_any_authenticated_packet_traversal+0x1f/0x100 drivers/net/wireguard/timers.c:217
 wg_packet_consume_data_done drivers/net/wireguard/receive.c:354 [inline]
 wg_packet_rx_poll+0x7b2/0x1090 drivers/net/wireguard/receive.c:474
 __napi_poll+0x61/0x300 net/core/dev.c:7787
 napi_threaded_poll_loop+0x1e9/0x6c0 net/core/dev.c:7907
 napi_threaded_poll+0x193/0x240 net/core/dev.c:7962
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0xffff -> 0x0001

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3652 Comm: napi/wg0-0 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/24 05:10 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 62f4c998b297 f65209a4 .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in wg_set_device_doit / wg_timers_any_authenticated_packet_traversal
* Struck through repros no longer work on HEAD.