KCSAN: data-race in io_prep_async_work / prepare_creds

Status: moderation: reported C repro on 2026/09/06 15:01
Subsystems: io-uring
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+ee58b040032d8bed63d9@syzkaller.appspotmail.com
First crash: 45d, last: 9d03h
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
0675e416 repro-c Reproduced: ✅ ❓ KCSAN: data-race in io_prep_async_work / prepare_creds 2026/09/28 11:28 2026/09/28 11:28 2026/09/28 12:04 a3c7249d
10bbe05f assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in io_prep_async_work / prepare_creds 2026/09/08 00:01 2026/09/08 00:01 2026/09/08 00:38 680aa3e1
505fd029 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in io_prep_async_work / prepare_creds 2026/09/06 15:00 2026/09/06 15:00 2026/09/06 15:30 4f7b22a0
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/10/12 22:19 11m retest repro upstream report job log log
2026/09/28 13:49 9m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e report job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in io_prep_async_work / prepare_creds

write to 0xffff8881046cea68 of 4 bytes by task 3646 on cpu 1:
 get_cred_many include/linux/cred.h:222 [inline]
 get_cred include/linux/cred.h:238 [inline]
 io_prep_async_work+0x9b/0x3c0 io_uring/io_uring.c:367
 io_prep_async_link io_uring/io_uring.c:406 [inline]
 io_drain_req+0x10b/0x330 io_uring/io_uring.c:1341
 io_queue_sqe_fallback+0x13d/0x140 io_uring/io_uring.c:1665
 io_submit_sqe io_uring/io_uring.c:1920 [inline]
 io_submit_sqes+0xd43/0x1180 io_uring/io_uring.c:2048
 __do_sys_io_uring_enter io_uring/io_uring.c:2637 [inline]
 __se_sys_io_uring_enter+0x25c/0xf90 io_uring/io_uring.c:2586
 __x64_sys_io_uring_enter+0x78/0x90 io_uring/io_uring.c:2586
 x64_sys_call+0x1780/0x2550 arch/x86/include/generated/asm/syscalls_64.h:427
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881046ce9c0 of 184 bytes by task 3645 on cpu 0:
 prepare_creds+0x71/0x550 kernel/cred.c:192
 __do_sys_capset kernel/capability.c:247 [inline]
 __se_sys_capset+0x2da/0x480 kernel/capability.c:216
 __x64_sys_capset+0x31/0x40 kernel/capability.c:216
 x64_sys_call+0x1515/0x2550 arch/x86/include/generated/asm/syscalls_64.h:127
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3645 Comm: syz-executor846 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/28 13:58 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 72d3fcf802c4 4f7b22a0 .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in io_prep_async_work / prepare_creds
2026/09/06 15:00 upstream 1fc5a74b108f 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in io_prep_async_work / prepare_creds
* Struck through repros no longer work on HEAD.