WARNING in ip6gre_tunnel_xmit

Status: premoderation: reported C repro on 2026/08/23 19:29
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+ea263ebebc20a845edc1@syzkaller.appspotmail.com
First crash: 4d05h, last: 2d04h
Bug presence (2)
Date Name Commit Repro Result
2026/08/24 lts (merge base) 8c9d5557c8e6 C [report] WARNING in ip6gre_tunnel_xmit
2026/08/24 upstream (ToT) 4352b8aee980 C [report] WARNING in ip6gre_tunnel_xmit
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in ip6gre_tunnel_xmit net -1 syz, C done 2 914d 914d 25/29 fixed on 2024/03/26 00:54

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 313 at include/linux/skbuff.h:2824 pskb_may_pull_reason include/linux/skbuff.h:2824 [inline]
WARNING: CPU: 0 PID: 313 at include/linux/skbuff.h:2824 pskb_may_pull include/linux/skbuff.h:2840 [inline]
WARNING: CPU: 0 PID: 313 at include/linux/skbuff.h:2824 pskb_network_may_pull include/linux/skbuff.h:3199 [inline]
WARNING: CPU: 0 PID: 313 at include/linux/skbuff.h:2824 pskb_inet_may_pull include/net/ip_tunnels.h:466 [inline]
WARNING: CPU: 0 PID: 313 at include/linux/skbuff.h:2824 ip6gre_tunnel_xmit+0x1096/0x1440 net/ipv6/ip6_gre.c:913
Modules linked in:
CPU: 0 UID: 0 PID: 313 Comm: syz-executor160 Not tainted syzkaller #0 9a2c17613351c9eac8e18d74829f474689ac6bc1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:pskb_may_pull_reason include/linux/skbuff.h:2824 [inline]
RIP: 0010:pskb_may_pull include/linux/skbuff.h:2840 [inline]
RIP: 0010:pskb_network_may_pull include/linux/skbuff.h:3199 [inline]
RIP: 0010:pskb_inet_may_pull include/net/ip_tunnels.h:466 [inline]
RIP: 0010:ip6gre_tunnel_xmit+0x1096/0x1440 net/ipv6/ip6_gre.c:913
Code: 56 01 00 e9 91 fc ff ff e8 b7 cc 78 fc e9 87 fc ff ff e8 ad cc 78 fc 48 8b 44 24 08 c6 40 3a f8 e9 e8 f6 ff ff e8 9a cc 78 fc <0f> 0b e9 39 f1 ff ff 89 df 44 89 ee e8 49 ce 78 fc 44 39 eb 0f 87
RSP: 0018:ffffc9000120f240 EFLAGS: 00010293
RAX: ffffffff850ea526 RBX: 00000000ffffff40 RCX: ffff888122371300
RDX: 0000000000000000 RSI: 00000000ffffff40 RDI: 0000000000000000
RBP: ffffc9000120f500 R08: ffff888122371300 R09: 0000000000000002
R10: 0000000000000000 R11: ffffffff850e9490 R12: dffffc0000000000
R13: ffff88811f014a00 R14: 0000000000000000 R15: ffff88811f014ae8
FS:  00005555928833c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006a2140 CR3: 00000001067e2000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 __netdev_start_xmit include/linux/netdevice.h:5008 [inline]
 netdev_start_xmit include/linux/netdevice.h:5017 [inline]
 __dev_direct_xmit+0x395/0x5a0 net/core/dev.c:4614
 __xsk_generic_xmit net/xdp/xsk.c:826 [inline]
 xsk_generic_xmit+0x1bef/0x3060 net/xdp/xsk.c:868
 xsk_poll+0x2ca/0x580 net/xdp/xsk.c:999
 sock_poll+0x23b/0x400 net/socket.c:1414
 vfs_poll include/linux/poll.h:92 [inline]
 do_pollfd fs/select.c:872 [inline]
 do_poll fs/select.c:920 [inline]
 do_sys_poll+0x962/0x1210 fs/select.c:1015
 __do_sys_ppoll fs/select.c:1121 [inline]
 __se_sys_ppoll+0x20a/0x2b0 fs/select.c:1101
 __x64_sys_ppoll+0xc3/0xf0 fs/select.c:1101
 x64_sys_call+0xd20/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:272
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f54eb659bc9
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe88491298 EFLAGS: 00000246 ORIG_RAX: 000000000000010f
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f54eb659bc9
RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000080000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/23 19:28 android16-6.12 e8c85685a629 1e72964b .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust WARNING in ip6gre_tunnel_xmit
2026/08/25 20:27 android16-6.12 e8191d250396 a9a1fc32 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust WARNING in ip6gre_tunnel_xmit
2026/08/25 20:26 android16-6.12 e8191d250396 a9a1fc32 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust WARNING in ip6gre_tunnel_xmit
* Struck through repros no longer work on HEAD.