general protection fault in dvb_dmxdev_filter

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision
b76ed130	assessment-security	DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	general protection fault in dvb_dmxdev_filter_stop (2)	2026/09/03 00:22	2026/09/03 00:22	2026/09/03 01:03	9941e97d

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	general protection fault in dvb_dmxdev_filter_stop media prio:high	2				1	190d	186d	0/29	auto-obsoleted due to no activity on 2026/05/27 22:24

Kernel

Title

Rank 🛈

upstream

general protection fault in dvb_dmxdev_filter_stop media prio:high

190d

186d

0/29

auto-obsoleted due to no activity on 2026/05/27 22:24

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 0 UID: 0 PID: 6439 Comm: syz.1.248 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:dvb_dmxdev_feed_stop drivers/media/dvb-core/dmxdev.c:494 [inline] RIP: 0010:dvb_dmxdev_filter_stop+0x19f/0x700 drivers/media/dvb-core/dmxdev.c:572 Code: 00 00 49 8d 5c 24 f8 48 89 d8 48 c1 e8 03 80 3c 28 00 74 08 48 89 df e8 ef 4c a5 fa 48 8b 1b 48 8d 7b 28 48 89 f8 48 c1 e8 03 <80> 3c 28 00 74 05 e8 d6 4c a5 fa 4c 8b 5b 28 48 89 df 2e 2e 2e 41 RSP: 0018:ffffc90006e67c70 EFLAGS: 00010206 RAX: 0000000000000005 RBX: 0000000000000000 RCX: 0000000000000005 RDX: ffffffff878cdb3a RSI: ffffffff8f0c10f0 RDI: 0000000000000028 RBP: dffffc0000000000 R08: ffff888035db8000 R09: 0000000000000002 R10: 0000000000000100 R11: 0000000000000002 R12: ffff88802be5fb90 R13: 1ffff92000fdb80c R14: ffffc90007edc054 R15: ffffc90007edc008 FS: 000055557bd66500(0000) GS:ffff888125bd6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd2b3595690 CR3: 0000000031a3c000 CR4: 00000000003526f0 Call Trace: <TASK> dvb_dmxdev_filter_free drivers/media/dvb-core/dmxdev.c:856 [inline] dvb_demux_release+0x9b/0x6b0 drivers/media/dvb-core/dmxdev.c:1256 __fput+0x42a/0xa80 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f432b08e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe1f2da618 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f432b317da0 RCX: 00007f432b08e159 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f432b317da0 R08: 00007f432b316218 R09: 0000000000000000 R10: 00000000005f6dc4 R11: 0000000000000246 R12: 00000000000210f4 R13: 00007f432b31618c R14: 0000000000020e82 R15: 00007ffe1f2da720 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:dvb_dmxdev_feed_stop drivers/media/dvb-core/dmxdev.c:494 [inline] RIP: 0010:dvb_dmxdev_filter_stop+0x19f/0x700 drivers/media/dvb-core/dmxdev.c:572 Code: 00 00 49 8d 5c 24 f8 48 89 d8 48 c1 e8 03 80 3c 28 00 74 08 48 89 df e8 ef 4c a5 fa 48 8b 1b 48 8d 7b 28 48 89 f8 48 c1 e8 03 <80> 3c 28 00 74 05 e8 d6 4c a5 fa 4c 8b 5b 28 48 89 df 2e 2e 2e 41 RSP: 0018:ffffc90006e67c70 EFLAGS: 00010206 RAX: 0000000000000005 RBX: 0000000000000000 RCX: 0000000000000005 RDX: ffffffff878cdb3a RSI: ffffffff8f0c10f0 RDI: 0000000000000028 RBP: dffffc0000000000 R08: ffff888035db8000 R09: 0000000000000002 R10: 0000000000000100 R11: 0000000000000002 R12: ffff88802be5fb90 R13: 1ffff92000fdb80c R14: ffffc90007edc054 R15: ffffc90007edc008 FS: 000055557bd66500(0000) GS:ffff888125bd6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd2b3595690 CR3: 0000000031a3c000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 49 8d 5c 24 f8 lea -0x8(%r12),%rbx 7: 48 89 d8 mov %rbx,%rax a: 48 c1 e8 03 shr $0x3,%rax e: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) 12: 74 08 je 0x1c 14: 48 89 df mov %rbx,%rdi 17: e8 ef 4c a5 fa call 0xfaa54d0b 1c: 48 8b 1b mov (%rbx),%rbx 1f: 48 8d 7b 28 lea 0x28(%rbx),%rdi 23: 48 89 f8 mov %rdi,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction 2e: 74 05 je 0x35 30: e8 d6 4c a5 fa call 0xfaa54d0b 35: 4c 8b 5b 28 mov 0x28(%rbx),%r11 39: 48 89 df mov %rbx,%rdi 3c: 2e cs 3d: 2e cs 3e: 2e cs 3f: 41 rex.B

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/09/01 14:55	upstream	786262be6048	316d9396	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce-smack-root	general protection fault in dvb_dmxdev_filter_stop

Crashes (1):

Assets (help?)