VFS: Close: file count is zero (use-after-free) (2)

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision	Error
2949a68b	assessment-security	DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	VFS: Close: file count is zero (use-after-free) (2)	2026/08/01 00:09	2026/08/01 00:09	2026/08/01 01:03	7664cf44

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	VFS: Close: file count is zero (use-after-free) squashfs	2	syz, C	done		16	780d	793d	0/29	auto-obsoleted due to no activity on 2024/07/25 12:57

Kernel

Title

Rank 🛈

upstream

VFS: Close: file count is zero (use-after-free) squashfs

syz, C

done

780d

793d

0/29

auto-obsoleted due to no activity on 2024/07/25 12:57

slab filp start ffff88803ff82380 pointer offset 0 size 352 VFS: Close: file count is 0 (f_op=snd_ctl_f_ops) ------------[ cut here ]------------ kernel BUG at fs/open.c:1466! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:filp_flush+0x184/0x190 fs/open.c:1464 Code: 48 83 c3 48 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 dc 13 ee ff 48 8b 33 48 c7 c7 80 8c fe 8b e8 4d 7e df fe 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc9000f8b76b8 EFLAGS: 00010246 RAX: 0000000000000030 RBX: ffff88803ff823c8 RCX: 875a647d18f52e00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffffc9000f8b77d8 R08: ffff88801fc24713 R09: 1ffff11003f848e2 R10: dffffc0000000000 R11: ffffed1003f848e3 R12: dffffc0000000000 R13: ffff88803a39e528 R14: 0000000000000000 R15: 0000000000000003 FS: 00007fe0b3c2d6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000408c7000 CR4: 0000000000352ef0 Call Trace: <TASK> filp_close+0x1d/0x40 fs/open.c:1484 gaudio_close_snd_dev drivers/usb/gadget/function/u_uac1_legacy.c:263 [inline] gaudio_cleanup+0x54/0xf0 drivers/usb/gadget/function/u_uac1_legacy.c:305 f_audio_bind+0x4a0/0x630 drivers/usb/gadget/function/f_uac1_legacy.c:792 usb_add_function+0x2e1/0x9f0 drivers/usb/gadget/composite.c:333 configfs_composite_bind+0xde0/0x1410 drivers/usb/gadget/configfs.c:1802 gadget_bind_driver+0x2ca/0x9e0 drivers/usb/gadget/udc/core.c:1662 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __driver_attach+0x339/0x600 drivers/base/dd.c:1292 bus_for_each_dev+0x23b/0x2c0 drivers/base/bus.c:383 bus_add_driver+0x345/0x670 drivers/base/bus.c:763 driver_register+0x23a/0x320 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0xf9/0x270 drivers/usb/gadget/udc/core.c:1752 gadget_dev_desc_UDC_store+0x1c9/0x2f0 drivers/usb/gadget/configfs.c:300 flush_write_buffer fs/configfs/file.c:207 [inline] configfs_write_iter+0x337/0x430 fs/configfs/file.c:229 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe0b2d9e019 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe0b3c2cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fe0b3025fa0 RCX: 00007fe0b2d9e019 RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000008 RBP: 00007fe0b2e3500c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fe0b3026038 R14: 00007fe0b3025fa0 R15: 00007ffe19388eb8 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:filp_flush+0x184/0x190 fs/open.c:1464 Code: 48 83 c3 48 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 dc 13 ee ff 48 8b 33 48 c7 c7 80 8c fe 8b e8 4d 7e df fe 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc9000f8b76b8 EFLAGS: 00010246 RAX: 0000000000000030 RBX: ffff88803ff823c8 RCX: 875a647d18f52e00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffffc9000f8b77d8 R08: ffff88801fc24713 R09: 1ffff11003f848e2 R10: dffffc0000000000 R11: ffffed1003f848e3 R12: dffffc0000000000 R13: ffff88803a39e528 R14: 0000000000000000 R15: 0000000000000003 FS: 00007fe0b3c2d6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000408c7000 CR4: 0000000000352ef0

Crashes (6):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Assets (help?)	Manager	Title
2026/08/04 10:03	upstream	848acc8ffe1b	9451e17e	.config	console log	report		[disk image (non-bootable)] [vmlinux] [kernel image]	ci-snapshot-upstream-root	VFS: Close: file count is zero (use-after-free)
2026/08/03 04:03	upstream	bd1dde877520	e611ffe1	.config	console log	report		[disk image (non-bootable)] [vmlinux] [kernel image]	ci-snapshot-upstream-root	VFS: Close: file count is zero (use-after-free)
2026/07/31 05:07	upstream	e05b559f9cda	aaffb173	.config	console log	report		[disk image (non-bootable)] [vmlinux] [kernel image]	ci-snapshot-upstream-root	VFS: Close: file count is zero (use-after-free)
2026/07/30 17:15	upstream	11028ab62899	0a1bc234	.config	console log	report		[disk image (non-bootable)] [vmlinux] [kernel image]	ci-snapshot-upstream-root	VFS: Close: file count is zero (use-after-free)
2026/07/31 15:58	upstream	8ba098e6b6ff	db462e94	.config	console log	report	info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream-386	VFS: Close: file count is zero (use-after-free)
2026/07/30 10:29	https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master	fc46aed51f62	2377cd3d	.config	console log	report	info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu2-arm32	VFS: Close: file count is zero (use-after-free)

Crashes (6):

Assets (help?)