cess permissive=1 [ 14.155062][ T24] audit: type=1400 audit(1785275192.820:63): avc: denied { siginh } for pid=216 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.175' (ED25519) to the list of known hosts. 2026/07/28 21:46:42 parsed 1 programs 2026/07/28 21:46:42 serving rpc on tcp://39211 [ 23.599370][ T24] audit: type=1400 audit(1785275202.300:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 23.620310][ T24] audit: type=1400 audit(1785275202.310:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 23.640635][ T24] audit: type=1400 audit(1785275202.310:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 24.543954][ T24] audit: type=1400 audit(1785275203.250:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.547672][ T293] cgroup: Unknown subsys name 'net' [ 24.566842][ T24] audit: type=1400 audit(1785275203.250:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.594166][ T24] audit: type=1400 audit(1785275203.280:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.594678][ T293] cgroup: Unknown subsys name 'devices' [ 24.741648][ T293] cgroup: Unknown subsys name 'hugetlb' [ 24.747302][ T293] cgroup: Unknown subsys name 'rlimit' [ 24.925983][ T24] audit: type=1400 audit(1785275203.630:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.949175][ T24] audit: type=1400 audit(1785275203.630:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.969903][ T24] audit: type=1400 audit(1785275203.630:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.990176][ T24] audit: type=1400 audit(1785275203.630:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.015479][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.039440][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.546231][ T304] request_module fs-gadgetfs succeeded, but still no fs? [ 25.577675][ T304] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 25.643973][ T305] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.674252][ T305] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.682167][ T305] device bridge_slave_0 entered promiscuous mode [ 25.690678][ T305] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.697731][ T305] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.705441][ T305] device bridge_slave_1 entered promiscuous mode [ 25.912094][ T305] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.919186][ T305] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.926590][ T305] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.933671][ T305] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.130364][ T320] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.138702][ T320] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.155757][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.167891][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.231628][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.244041][ T320] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.251240][ T320] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.262645][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.271062][ T320] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.278118][ T320] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.314410][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.326464][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.351515][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.367530][ T305] device veth0_vlan entered promiscuous mode [ 26.379153][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.388252][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.396358][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.413208][ T305] device veth1_macvtap entered promiscuous mode [ 26.421036][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.433125][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.449948][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/28 21:46:45 executed programs: 0 [ 26.734858][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.742038][ T370] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.749399][ T370] device bridge_slave_0 entered promiscuous mode [ 26.776801][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.784039][ T370] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.791642][ T370] device bridge_slave_1 entered promiscuous mode [ 26.847757][ T375] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.855241][ T375] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.862854][ T375] device bridge_slave_0 entered promiscuous mode [ 26.869541][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.876938][ T374] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.884460][ T374] device bridge_slave_0 entered promiscuous mode [ 26.891382][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.898426][ T374] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.906007][ T374] device bridge_slave_1 entered promiscuous mode [ 26.922363][ T375] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.929441][ T375] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.936910][ T375] device bridge_slave_1 entered promiscuous mode [ 26.964292][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.971552][ T371] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.978972][ T371] device bridge_slave_0 entered promiscuous mode [ 26.988431][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.995521][ T371] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.003165][ T371] device bridge_slave_1 entered promiscuous mode [ 27.057589][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.064823][ T373] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.072503][ T373] device bridge_slave_0 entered promiscuous mode [ 27.094427][ T373] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.101619][ T373] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.109074][ T373] device bridge_slave_1 entered promiscuous mode [ 27.240325][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.247422][ T370] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.254757][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.261813][ T370] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.272015][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.279105][ T374] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.286391][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.293456][ T374] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.303527][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.310799][ T371] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.318081][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.325153][ T371] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.342870][ T373] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.349993][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.357268][ T373] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.364345][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.405693][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.413516][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.421045][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.428315][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.436145][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.443547][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.450909][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.458497][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.465927][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.491082][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.499275][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.506359][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.513941][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.522864][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.529945][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.564782][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.572502][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.581898][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.591001][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.598063][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.606089][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.614569][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.621663][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.629225][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.637560][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.644658][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.652174][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.660413][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.667448][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.674894][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.682891][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.691176][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.699114][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.738406][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.746392][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.754522][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 27.763461][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.772426][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.779464][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.787083][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 27.795835][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.804435][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.811548][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.818954][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 27.827152][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.835656][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.844044][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.852121][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.860511][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.868803][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.877281][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.901633][ T370] device veth0_vlan entered promiscuous mode [ 27.912756][ T371] device veth0_vlan entered promiscuous mode [ 27.924960][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.933742][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.942136][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 27.951542][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.959632][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 27.968309][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.976748][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.983855][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.991798][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 28.000344][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.008371][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 28.016969][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.025273][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.032325][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.039921][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 28.047975][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.056357][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 28.064539][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.072533][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 28.080487][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.088426][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 28.096433][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.104484][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 28.112417][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.119922][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.127320][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.135107][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.149473][ T373] device veth0_vlan entered promiscuous mode [ 28.168863][ T375] device veth0_vlan entered promiscuous mode [ 28.175399][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.185088][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.193607][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.202405][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.210139][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 28.218407][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.226944][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 28.235513][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.244504][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 28.252645][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.260732][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.268321][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.279413][ T374] device veth0_vlan entered promiscuous mode [ 28.290422][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 28.298324][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.306932][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 28.315525][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.329537][ T374] device veth1_macvtap entered promiscuous mode [ 28.340856][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.349083][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.357891][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.365672][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.373533][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 28.382072][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.390434][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 28.399031][ T370] device veth1_macvtap entered promiscuous mode [ 28.408496][ T373] device veth1_macvtap entered promiscuous mode [ 28.420349][ T375] device veth1_macvtap entered promiscuous mode [ 28.427727][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 28.435874][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 28.444288][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.453418][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.462075][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.474636][ T371] device veth1_macvtap entered promiscuous mode [ 28.484542][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.492959][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 28.501448][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.510271][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.518462][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.548824][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 28.558020][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.566561][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 28.575620][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.584459][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 28.593085][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.601560][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.610078][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.618498][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.629135][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.664613][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.673412][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.140881][ T283] device bridge_slave_1 left promiscuous mode [ 29.147150][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.186367][ T283] device bridge_slave_0 left promiscuous mode [ 29.197464][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.244205][ T283] device veth1_macvtap left promiscuous mode [ 29.269905][ T283] device veth0_vlan left promiscuous mode [ 31.153059][ T1430] ------------[ cut here ]------------ [ 31.158587][ T1430] refcount_t: addition on 0; use-after-free. [ 31.164783][ T1430] WARNING: CPU: 0 PID: 1430 at lib/refcount.c:25 refcount_warn_saturate+0x104/0x1a0 [ 31.174327][ T1430] Modules linked in: [ 31.178248][ T1430] CPU: 0 PID: 1430 Comm: syz.5.518 Not tainted syzkaller #0 [ 31.185602][ T1430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 31.195861][ T1430] RIP: 0010:refcount_warn_saturate+0x104/0x1a0 [ 31.202068][ T1430] Code: 04 01 48 c7 c7 a0 49 40 85 e8 98 ca 3a 02 0f 0b eb df e8 8f 89 26 ff c6 05 cc 75 82 04 01 48 c7 c7 e0 48 40 85 e8 7c ca 3a 02 <0f> 0b eb c3 e8 73 89 26 ff c6 05 b1 75 82 04 01 48 c7 c7 40 49 40 [ 31.221856][ T1430] RSP: 0018:ffffc9000135fc98 EFLAGS: 00010246 [ 31.227960][ T1430] RAX: cdbfb1a45e3c3d00 RBX: 0000000000000002 RCX: ffff888119b7e2c0 [ 31.235964][ T1430] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 31.244028][ T1430] RBP: ffffc9000135fca8 R08: ffffc9000135f627 R09: fffff5200026bef8 [ 31.252210][ T1430] R10: dffffc0000000000 R11: fffff5200026bec5 R12: ffff888116334b70 [ 31.260267][ T1430] R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000 [ 31.268255][ T1430] FS: 00007ff9cee1b6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 31.277305][ T1430] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.283926][ T1430] CR2: 0000001b34063fff CR3: 000000012f017000 CR4: 00000000003506b0 [ 31.291941][ T1430] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.299950][ T1430] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.308040][ T1430] Call Trace: [ 31.311380][ T1430] config_item_get+0x8c/0x90 [ 31.316077][ T1430] configfs_symlink+0x44f/0x1320 [ 31.321082][ T1430] ? show_sid+0x1b0/0x1b0 [ 31.325457][ T1430] ? __lookup_hash+0x122/0x250 [ 31.330260][ T1430] ? detach_groups+0x2e0/0x2e0 [ 31.335039][ T1430] ? selinux_inode_symlink+0x22/0x30 [ 31.340392][ T1430] ? security_inode_symlink+0xba/0x100 [ 31.345865][ T1430] vfs_symlink+0x339/0x4c0 [ 31.350316][ T1430] do_symlinkat+0x10e/0x3d0 [ 31.354845][ T1430] __x64_sys_symlinkat+0x7b/0x90 [ 31.359821][ T1430] do_syscall_64+0x31/0x40 [ 31.364251][ T1430] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.370187][ T1430] RIP: 0033:0x7ff9cefb9e99 [ 31.374638][ T1430] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.394282][ T1430] RSP: 002b:00007ff9cee1b028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 31.402757][ T1430] RAX: ffffffffffffffda RBX: 00007ff9cf241fa0 RCX: 00007ff9cefb9e99 [ 31.410790][ T1430] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300 [ 31.418793][ T1430] RBP: 00007ff9cf04feaf R08: 0000000000000000 R09: 0000000000000000 [ 31.426787][ T1430] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 31.434887][ T1430] R13: 00007ff9cf242038 R14: 00007ff9cf241fa0 R15: 00007fff58709e08 [ 31.442988][ T1430] ---[ end trace f0442e3d7ca7e47b ]--- [ 31.450307][ T1430] ================================================================== [ 31.458426][ T1430] BUG: KASAN: use-after-free in config_item_put+0x33/0x210 [ 31.465656][ T1430] Write of size 4 at addr ffff88811739701c by task syz.5.518/1430 [ 31.473466][ T1430] [ 31.475854][ T1430] CPU: 1 PID: 1430 Comm: syz.5.518 Tainted: G W syzkaller #0 [ 31.484538][ T1430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 31.494612][ T1430] Call Trace: [ 31.497930][ T1430] __dump_stack+0x21/0x24 [ 31.502297][ T1430] dump_stack_lvl+0x1a7/0x208 [ 31.507011][ T1430] ? show_regs_print_info+0x18/0x18 [ 31.512236][ T1430] ? thaw_kernel_threads+0x220/0x220 [ 31.517539][ T1430] print_address_description+0x7f/0x2c0 [ 31.523099][ T1430] ? config_item_put+0x33/0x210 [ 31.527972][ T1430] kasan_report+0x100/0x140 [ 31.532599][ T1430] ? config_item_put+0x33/0x210 [ 31.537489][ T1430] kasan_check_range+0x249/0x2a0 [ 31.542466][ T1430] __kasan_check_write+0x14/0x20 [ 31.547412][ T1430] config_item_put+0x33/0x210 [ 31.552121][ T1430] configfs_symlink+0x4a6/0x1320 [ 31.557098][ T1430] ? show_sid+0x1b0/0x1b0 [ 31.561443][ T1430] ? __lookup_hash+0x122/0x250 [ 31.566219][ T1430] ? detach_groups+0x2e0/0x2e0 [ 31.571004][ T1430] ? selinux_inode_symlink+0x22/0x30 [ 31.576316][ T1430] ? security_inode_symlink+0xba/0x100 [ 31.581781][ T1430] vfs_symlink+0x339/0x4c0 [ 31.586206][ T1430] do_symlinkat+0x10e/0x3d0 [ 31.590722][ T1430] __x64_sys_symlinkat+0x7b/0x90 [ 31.595670][ T1430] do_syscall_64+0x31/0x40 [ 31.600089][ T1430] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.605991][ T1430] RIP: 0033:0x7ff9cefb9e99 [ 31.610417][ T1430] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.630049][ T1430] RSP: 002b:00007ff9cee1b028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 31.638472][ T1430] RAX: ffffffffffffffda RBX: 00007ff9cf241fa0 RCX: 00007ff9cefb9e99 [ 31.646449][ T1430] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300 [ 31.654449][ T1430] RBP: 00007ff9cf04feaf R08: 0000000000000000 R09: 0000000000000000 [ 31.662430][ T1430] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 31.670499][ T1430] R13: 00007ff9cf242038 R14: 00007ff9cf241fa0 R15: 00007fff58709e08 [ 31.678479][ T1430] [ 31.680815][ T1430] Allocated by task 1437: [ 31.685153][ T1430] __kasan_kmalloc+0xd4/0x100 [ 31.689832][ T1430] kmem_cache_alloc_trace+0x179/0x2e0 [ 31.695208][ T1430] afunc_alloc_inst+0x4c/0x310 [ 31.699973][ T1430] usb_get_function_instance+0xe2/0x2f0 [ 31.705527][ T1430] function_make+0x118/0x350 [ 31.710147][ T1430] configfs_mkdir+0x5d2/0xd90 [ 31.714834][ T1430] vfs_mkdir+0x42c/0x600 [ 31.719084][ T1430] do_mkdirat+0x14c/0x340 [ 31.723420][ T1430] __x64_sys_mkdirat+0x7b/0x90 [ 31.728188][ T1430] do_syscall_64+0x31/0x40 [ 31.732606][ T1430] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.738502][ T1430] [ 31.740858][ T1430] Freed by task 1437: [ 31.744887][ T1430] kasan_set_track+0x4a/0x70 [ 31.749488][ T1430] kasan_set_free_info+0x23/0x40 [ 31.754437][ T1430] ____kasan_slab_free+0x125/0x160 [ 31.759560][ T1430] __kasan_slab_free+0x11/0x20 [ 31.764326][ T1430] slab_free_freelist_hook+0xc5/0x190 [ 31.769700][ T1430] kfree+0xc0/0x270 [ 31.773519][ T1430] afunc_free_inst+0x15/0x20 [ 31.778113][ T1430] usb_put_function_instance+0x85/0xa0 [ 31.783577][ T1430] f_uac2_attr_release+0x15/0x20 [ 31.788533][ T1430] config_item_put+0x158/0x210 [ 31.793299][ T1430] configfs_rmdir+0x89f/0x960 [ 31.797980][ T1430] vfs_rmdir+0x1ab/0x3c0 [ 31.802231][ T1430] do_rmdir+0x232/0x630 [ 31.806393][ T1430] __x64_sys_unlinkat+0xc7/0xf0 [ 31.811251][ T1430] do_syscall_64+0x31/0x40 [ 31.815669][ T1430] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.821569][ T1430] [ 31.823909][ T1430] The buggy address belongs to the object at ffff888117397000 [ 31.823909][ T1430] which belongs to the cache kmalloc-512 of size 512 [ 31.837966][ T1430] The buggy address is located 28 bytes inside of [ 31.837966][ T1430] 512-byte region [ffff888117397000, ffff888117397200) [ 31.851258][ T1430] The buggy address belongs to the page: [ 31.856923][ T1430] page:ffffea00045ce500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117394 [ 31.867165][ T1430] head:ffffea00045ce500 order:2 compound_mapcount:0 compound_pincount:0 [ 31.875492][ T1430] flags: 0x4000000000010200(slab|head) [ 31.880964][ T1430] raw: 4000000000010200 ffffea0004afc300 0000000500000005 ffff888100043080 [ 31.889564][ T1430] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 31.898147][ T1430] page dumped because: kasan: bad access detected [ 31.904561][ T1430] page_owner tracks the page as allocated [ 31.910299][ T1430] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 97, ts 6010310959, free_ts 0 [ 31.928289][ T1430] prep_new_page+0x176/0x190 [ 31.932887][ T1430] get_page_from_freelist+0x225f/0x23f0 [ 31.938443][ T1430] __alloc_pages_nodemask+0x29a/0x640 [ 31.943814][ T1430] new_slab+0x84/0x3f0 [ 31.947886][ T1430] ___slab_alloc+0x2f8/0x4c0 [ 31.952476][ T1430] __slab_alloc+0x63/0xa0 [ 31.956813][ T1430] __kmalloc_track_caller+0x1e4/0x310 [ 31.962192][ T1430] __alloc_skb+0xdc/0x520 [ 31.966520][ T1430] alloc_skb_with_frags+0xa3/0x560 [ 31.971648][ T1430] sock_alloc_send_pskb+0x87f/0x9a0 [ 31.976863][ T1430] unix_dgram_sendmsg+0x6f3/0x18f0 [ 31.981985][ T1430] sock_write_iter+0x2a6/0x3a0 [ 31.986751][ T1430] vfs_write+0x770/0xd70 [ 31.991009][ T1430] ksys_write+0x14a/0x260 [ 31.995342][ T1430] __x64_sys_write+0x7b/0x90 [ 31.999934][ T1430] do_syscall_64+0x31/0x40 [ 32.004350][ T1430] page_owner free stack trace missing [ 32.009727][ T1430] [ 32.012087][ T1430] Memory state around the buggy address: [ 32.017730][ T1430] ffff888117396f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.025821][ T1430] ffff888117396f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.033972][ T1430] >ffff888117397000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.042035][ T1430] ^ [ 32.046891][ T1430] ffff888117397080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb 2026/07/28 21:46:50 executed programs: 516 [ 32.054975][ T1430] ffff888117397100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.063038][ T1430] ================================================================== [ 32.071100][ T1430] Disabling lock debugging due to kernel taint [ 32.081966][ T1430] ------------[ cut here ]------------ [ 32.087757][ T1430] refcount_t: underflow; use-after-free. [ 32.095794][ T1430] WARNING: CPU: 1 PID: 1430 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 32.106910][ T1430] Modules linked in: [ 32.111140][ T1430] CPU: 1 PID: 1430 Comm: syz.5.518 Tainted: G B W syzkaller #0 [ 32.114260][ T24] kauditd_printk_skb: 41 callbacks suppressed [ 32.114291][ T24] audit: type=1400 audit(1785275210.820:115): avc: denied { read } for pid=76 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 32.119890][ T1430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 32.119912][ T1430] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 32.119923][ T1430] Code: 04 01 48 c7 c7 e0 48 40 85 e8 7c ca 3a 02 0f 0b eb c3 e8 73 89 26 ff c6 05 b1 75 82 04 01 48 c7 c7 40 49 40 85 e8 60 ca 3a 02 <0f> 0b eb a7 e8 57 89 26 ff c6 05 92 75 82 04 01 48 c7 c7 60 48 40 [ 32.119930][ T1430] RSP: 0018:ffffc9000135fc78 EFLAGS: 00010246 [ 32.119949][ T1430] RAX: cdbfb1a45e3c3d00 RBX: 0000000000000003 RCX: ffff888119b7e2c0 [ 32.146472][ T24] audit: type=1400 audit(1785275210.830:116): avc: denied { search } for pid=76 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.150693][ T1430] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 32.175360][ T24] audit: type=1400 audit(1785275210.830:117): avc: denied { write } for pid=76 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.189498][ T1430] RBP: ffffc9000135fc88 R08: ffffc9000135f607 R09: fffff5200026bef4 [ 32.190910][ T24] audit: type=1400 audit(1785275210.830:118): avc: denied { add_name } for pid=76 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.198497][ T1430] R10: dffffc0000000000 R11: fffff5200026bec1 R12: 00000000ffffffea [ 32.220338][ T24] audit: type=1400 audit(1785275210.830:119): avc: denied { create } for pid=76 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 32.228323][ T1430] R13: dffffc0000000000 R14: 0000000000000003 R15: 00000000c0000000 [ 32.250155][ T24] audit: type=1400 audit(1785275210.840:120): avc: denied { append open } for pid=76 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 32.258162][ T1430] FS: 00007ff9cee1b6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 32.278499][ T24] audit: type=1400 audit(1785275210.840:121): avc: denied { getattr } for pid=76 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 32.285465][ T1430] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.375119][ T1430] CR2: 00007f20fa67f580 CR3: 000000012f017000 CR4: 00000000003506a0 [ 32.383219][ T1430] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.391226][ T1430] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.399202][ T1430] Call Trace: [ 32.402587][ T1430] config_item_put+0x200/0x210 [ 32.407369][ T1430] configfs_symlink+0x4a6/0x1320 [ 32.412638][ T1430] ? show_sid+0x1b0/0x1b0 [ 32.417090][ T1430] ? __lookup_hash+0x122/0x250 [ 32.421924][ T1430] ? detach_groups+0x2e0/0x2e0 [ 32.426729][ T1430] ? selinux_inode_symlink+0x22/0x30 [ 32.432079][ T1430] ? security_inode_symlink+0xba/0x100 [ 32.437570][ T1430] vfs_symlink+0x339/0x4c0 [ 32.442035][ T1430] do_symlinkat+0x10e/0x3d0 [ 32.446569][ T1430] __x64_sys_symlinkat+0x7b/0x90 [ 32.451786][ T1430] do_syscall_64+0x31/0x40 [ 32.456230][ T1430] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.462326][ T1430] RIP: 0033:0x7ff9cefb9e99 [ 32.466783][ T1430] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.486645][ T1430] RSP: 002b:00007ff9cee1b028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 32.495189][ T1430] RAX: ffffffffffffffda RBX: 00007ff9cf241fa0 RCX: 00007ff9cefb9e99 [ 32.503225][ T1430] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300 [ 32.511246][ T1430] RBP: 00007ff9cf04feaf R08: 0000000000000000 R09: 0000000000000000 [ 32.519317][ T1430] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.527389][ T1430] R13: 00007ff9cf242038 R14: 00007ff9cf241fa0 R15: 00007fff58709e08 [ 32.535809][ T1430] ---[ end trace f0442e3d7ca7e47c ]--- 2026/07/28 21:46:55 executed programs: 1536