syzkaller syzkaller login: [ 8.172859][ T107] udevd (107) used greatest stack depth: 21824 bytes left [ 14.831843][ T30] kauditd_printk_skb: 48 callbacks suppressed [ 14.831859][ T30] audit: type=1400 audit(1779496602.221:59): avc: denied { transition } for pid=223 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.843313][ T30] audit: type=1400 audit(1779496602.221:60): avc: denied { noatsecure } for pid=223 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.850548][ T30] audit: type=1400 audit(1779496602.231:61): avc: denied { write } for pid=223 comm="sh" path="pipe:[1576]" dev="pipefs" ino=1576 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.870481][ T30] audit: type=1400 audit(1779496602.231:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.889189][ T30] audit: type=1400 audit(1779496602.231:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.49' (ED25519) to the list of known hosts. 2026/05/23 00:36:52 parsed 1 programs [ 25.361442][ T30] audit: type=1400 audit(1779496612.751:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 25.382972][ T30] audit: type=1400 audit(1779496612.751:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 26.040494][ T30] audit: type=1400 audit(1779496613.431:66): avc: denied { mounton } for pid=299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 26.041506][ T299] cgroup: Unknown subsys name 'net' [ 26.063420][ T30] audit: type=1400 audit(1779496613.431:67): avc: denied { mount } for pid=299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.091582][ T30] audit: type=1400 audit(1779496613.461:68): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.091743][ T299] cgroup: Unknown subsys name 'devices' [ 26.204481][ T299] cgroup: Unknown subsys name 'hugetlb' [ 26.210195][ T299] cgroup: Unknown subsys name 'rlimit' [ 26.321891][ T30] audit: type=1400 audit(1779496613.711:69): avc: denied { setattr } for pid=299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.346040][ T30] audit: type=1400 audit(1779496613.711:70): avc: denied { create } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.351898][ T303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.367169][ T30] audit: type=1400 audit(1779496613.711:71): avc: denied { write } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.396303][ T30] audit: type=1400 audit(1779496613.711:72): avc: denied { read } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.407943][ T299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.417513][ T30] audit: type=1400 audit(1779496613.711:73): avc: denied { mounton } for pid=299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.893488][ T305] request_module fs-gadgetfs succeeded, but still no fs? [ 27.165579][ T332] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.172632][ T332] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.180486][ T332] device bridge_slave_0 entered promiscuous mode [ 27.188721][ T332] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.195993][ T332] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.203331][ T332] device bridge_slave_1 entered promiscuous mode [ 27.242072][ T332] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.249409][ T332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.256729][ T332] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.263859][ T332] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.281034][ T333] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.288437][ T333] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.296765][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.304514][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.314383][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.322848][ T333] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.329945][ T333] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.338556][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.346822][ T333] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.354196][ T333] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.366797][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.375920][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.389571][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.401947][ T332] device veth0_vlan entered promiscuous mode [ 27.415333][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.423983][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.431380][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.439160][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.448728][ T332] device veth1_macvtap entered promiscuous mode [ 27.458239][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.467954][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.496783][ T332] syz-executor (332) used greatest stack depth: 20640 bytes left 2026/05/23 00:36:55 executed programs: 0 [ 28.113178][ T369] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.120417][ T369] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.128315][ T369] device bridge_slave_0 entered promiscuous mode [ 28.135804][ T369] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.142908][ T369] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.150219][ T369] device bridge_slave_1 entered promiscuous mode [ 28.160330][ T45] device bridge_slave_1 left promiscuous mode [ 28.166543][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.174504][ T45] device bridge_slave_0 left promiscuous mode [ 28.180643][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.188809][ T45] device veth1_macvtap left promiscuous mode [ 28.194875][ T45] device veth0_vlan left promiscuous mode [ 28.335591][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.343215][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.352567][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 28.361044][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.369480][ T333] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.376562][ T333] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.384287][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 28.393827][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 28.402225][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.410531][ T333] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.417855][ T333] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.428832][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.438713][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.451448][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.472838][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.481009][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.488899][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.497249][ T369] device veth0_vlan entered promiscuous mode [ 28.508810][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.518384][ T369] device veth1_macvtap entered promiscuous mode [ 28.528741][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.538453][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.718009][ T376] general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] PREEMPT SMP KASAN [ 28.729765][ T376] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] [ 28.738513][ T376] CPU: 0 PID: 376 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.745800][ T376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 28.756140][ T376] RIP: 0010:vfs_rename+0x1b0/0x10f0 [ 28.761349][ T376] Code: 30 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 f3 ea f4 ff 48 8b 1b 48 8b 44 24 30 4c 8d 70 30 4d 89 f7 49 c1 ef 03 <43> 80 3c 27 00 74 08 4c 89 f7 e8 d1 ea f4 ff 48 89 5c 24 50 4c 89 [ 28.781087][ T376] RSP: 0018:ffffc900023a7b60 EFLAGS: 00010202 [ 28.787327][ T376] RAX: 0000000000000010 RBX: ffff888120389f80 RCX: ffff88810fb4e2c0 [ 28.795304][ T376] RDX: 0000000000000000 RSI: 0000000000400000 RDI: 0000000000200000 [ 28.803382][ T376] RBP: ffffc900023a7cd0 R08: ffff88810d098e2f R09: 1ffff11021a131c5 [ 28.811474][ T376] R10: dffffc0000000000 R11: ffffed1021a131c6 R12: dffffc0000000000 [ 28.819627][ T376] R13: ffff888120388000 R14: 0000000000000040 R15: 0000000000000008 [ 28.827851][ T376] FS: 00007fea0a9266c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 28.836882][ T376] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.843542][ T376] CR2: 00007fea0a925ff8 CR3: 000000012b260000 CR4: 00000000003506b0 [ 28.851790][ T376] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.859890][ T376] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.868169][ T376] Call Trace: [ 28.871455][ T376] [ 28.874381][ T376] ? dentry_free+0xbd/0x150 [ 28.878877][ T376] ? __ia32_sys_link+0x90/0x90 [ 28.883717][ T376] ? fast_dput+0x83/0x290 [ 28.888066][ T376] ? dput+0x5b/0x90 [ 28.891883][ T376] ? lookup_one_qstr_excl+0x1de/0x250 [ 28.897336][ T376] do_renameat2+0x826/0xfd0 [ 28.901941][ T376] ? fsnotify_move+0x450/0x450 [ 28.906786][ T376] ? getname_flags+0x206/0x500 [ 28.912190][ T376] __x64_sys_rename+0x86/0x90 [ 28.917065][ T376] x64_sys_call+0x680/0x9a0 [ 28.921754][ T376] do_syscall_64+0x4c/0xa0 [ 28.926358][ T376] ? clear_bhb_loop+0x50/0xa0 [ 28.931143][ T376] ? clear_bhb_loop+0x50/0xa0 [ 28.935812][ T376] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.941700][ T376] RIP: 0033:0x7fea0ab05e59 [ 28.946307][ T376] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.966090][ T376] RSP: 002b:00007fea0a926028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 28.974512][ T376] RAX: ffffffffffffffda RBX: 00007fea0ad7f180 RCX: 00007fea0ab05e59 [ 28.982496][ T376] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000200000000100 [ 28.990726][ T376] RBP: 00007fea0ab9bd6f R08: 0000000000000000 R09: 0000000000000000 [ 28.998802][ T376] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.006761][ T376] R13: 00007fea0ad7f218 R14: 00007fea0ad7f180 R15: 00007ffdabaa1d28 [ 29.014814][ T376] [ 29.017824][ T376] Modules linked in: [ 29.023489][ T376] ---[ end trace bc12f3964c76528c ]--- [ 29.029180][ T376] RIP: 0010:vfs_rename+0x1b0/0x10f0 [ 29.034458][ T376] Code: 30 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 f3 ea f4 ff 48 8b 1b 48 8b 44 24 30 4c 8d 70 30 4d 89 f7 49 c1 ef 03 <43> 80 3c 27 00 74 08 4c 89 f7 e8 d1 ea f4 ff 48 89 5c 24 50 4c 89 [ 29.054586][ T376] RSP: 0018:ffffc900023a7b60 EFLAGS: 00010202 [ 29.060755][ T376] RAX: 0000000000000010 RBX: ffff888120389f80 RCX: ffff88810fb4e2c0 [ 29.069063][ T376] RDX: 0000000000000000 RSI: 0000000000400000 RDI: 0000000000200000 [ 29.077244][ T376] RBP: ffffc900023a7cd0 R08: ffff88810d098e2f R09: 1ffff11021a131c5 [ 29.085633][ T376] R10: dffffc0000000000 R11: ffffed1021a131c6 R12: dffffc0000000000 [ 29.094012][ T376] R13: ffff888120388000 R14: 0000000000000040 R15: 0000000000000008 [ 29.102156][ T376] FS: 00007fea0a9266c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 29.111894][ T376] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.118675][ T376] CR2: 00007fea0ab53540 CR3: 000000012b260000 CR4: 00000000003506a0 [ 29.126807][ T376] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.135164][ T376] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.143505][ T376] Kernel panic - not syncing: Fatal exception [ 29.149668][ T376] Kernel Offset: disabled [ 29.153984][ T376] Rebooting in 86400 seconds..