syzbot


KMSAN: kernel-infoleak in exc_page_fault

Status: upstream: reported on 2026/06/25 01:08
Subsystems: kasan
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+411634dace73dad6f4d4@syzkaller.appspotmail.com
First crash: 7d14h, last: 7d09h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
0bb1006b-d448-43eb-9707-195263db6b57 assessment-security DenialOfService: ❌ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KMSAN: kernel-infoleak in exc_page_fault 2026/06/23 00:08 2026/06/23 00:08 2026/06/23 01:11 5a630be623a83f54a0e7a5a72d78827acdc85248

			
		
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [kernel?] KMSAN: kernel-infoleak in exc_page_fault 1 (2) 2026/06/25 07:07
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel NULL pointer dereference in exc_page_fault kernel 10 5 669d 677d 0/29 closed as invalid on 2024/09/13 11:13

Sample crash report:
BUG: KMSAN: kernel-infoleak in rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline]
BUG: KMSAN: kernel-infoleak in rseq_update_usr include/linux/rseq_entry.h:536 [inline]
BUG: KMSAN: kernel-infoleak in rseq_exit_user_update include/linux/rseq_entry.h:645 [inline]
BUG: KMSAN: kernel-infoleak in __rseq_exit_to_user_mode_restart include/linux/rseq_entry.h:674 [inline]
BUG: KMSAN: kernel-infoleak in rseq_exit_to_user_mode_restart include/linux/rseq_entry.h:703 [inline]
BUG: KMSAN: kernel-infoleak in exit_to_user_mode_loop kernel/entry/common.c:103 [inline]
BUG: KMSAN: kernel-infoleak in __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
BUG: KMSAN: kernel-infoleak in irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline]
BUG: KMSAN: kernel-infoleak in irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline]
BUG: KMSAN: kernel-infoleak in irqentry_exit+0x4a6/0xa40 kernel/entry/common.c:165
 exc_page_fault+0x7e/0xb0 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x2b/0x30 arch/x86/include/asm/idtentry.h:595

Local variable st.i.i created at:
 __do_sys_statfs fs/statfs.c:193 [inline]
 __se_sys_statfs fs/statfs.c:191 [inline]
 __x64_sys_statfs+0x73/0x200 fs/statfs.c:191
 x64_sys_call+0x334c/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:138

Bytes 0-3 of 4 are uninitialized
Memory access of size 4 starts at ffff88811856be78
Data copied to user address 00007ff99a04cac0

CPU: 1 UID: 0 PID: 5314 Comm: rm Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
=====================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/21 05:56 upstream 9ecfb2f7287a 43bfcdb0 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in exc_page_fault
2026/06/21 01:02 upstream 9ecfb2f7287a 43bfcdb0 .config console log report [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: kernel-infoleak in exc_page_fault
* Struck through repros no longer work on HEAD.