BUG: unable to handle kernel paging request in addrconf_dad_work

Status: closed as invalid on 2026/10/13 18:27
Subsystems: net
Labels: prio:high
[Documentation on labels]
First crash: 5d14h, last: 5d14h
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
bc4f0f23 repro-c 💥 BUG: unable to handle kernel paging request in addrconf_dad_work 2026/10/13 10:11 2026/10/13 10:11 2026/10/13 10:52 745a967f
42d17f8b repro-c 💥 BUG: unable to handle kernel paging request in addrconf_dad_work 2026/10/12 04:02 2026/10/12 04:02 2026/10/12 09:12 4f92358f
739db4fb assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ✅ VMHostTrigger: ✅ ❓ BUG: unable to handle kernel paging request in addrconf_dad_work 2026/10/09 17:31 2026/10/09 17:31 2026/10/09 18:09 549ef7e3

Sample crash report:
Unable to handle kernel paging request at virtual address dfff800000000021
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000021] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 1238 Comm: kworker/u8:7 Tainted: G   M                syzkaller #0 PREEMPT 
Tainted: [M]=MACHINE_CHECK
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Workqueue: ipv6_addrconf addrconf_dad_work
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : read_pnet include/net/net_namespace.h:422 [inline]
pc : dev_net include/linux/netdevice.h:2810 [inline]
pc : addrconf_dad_work+0xe0/0xfe8 net/ipv6/addrconf.c:4228
lr : read_pnet include/net/net_namespace.h:422 [inline]
lr : dev_net include/linux/netdevice.h:2810 [inline]
lr : addrconf_dad_work+0xdc/0xfe8 net/ipv6/addrconf.c:4228
sp : ffff800096137a60
x29: ffff800096137b00 x28: ffff0000ca372c00 x27: dfff800000000000
x26: ffff700012c26f50 x25: ffff0000c8dd1d80 x24: 1fffe00019272c00
x23: ffff800096137a80 x22: ffff0000c8dd28c0 x21: ffff0000c9396000
x20: 0000000000000108 x19: ffff0000d9971890 x18: 1fffe000349fbc28
x17: ffff80011b89c000 x16: ffff80008f7f0000 x15: 0000000000000001
x14: 000000000024119e x13: 0000000000000002 x12: 0000000000000000
x11: 0000000000000000 x10: ffff700012c26f56 x9 : dfff800000000000
x8 : 0000000000000021 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/09 17:31 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 71c3e5409eef a8add9cd .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in addrconf_dad_work
* Struck through repros no longer work on HEAD.