Warning: Permanently added '10.128.1.70' (ED25519) to the list of known hosts. 2026/07/04 10:56:18 parsed 1 programs 2026/07/04 10:56:18 serving rpc on tcp://46147 [ 18.182530][ T24] audit: type=1400 audit(1783162578.429:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 18.187600][ T24] audit: type=1400 audit(1783162578.429:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 18.192968][ T24] audit: type=1400 audit(1783162578.429:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 18.785489][ T24] audit: type=1400 audit(1783162579.029:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 18.786493][ T293] cgroup: Unknown subsys name 'net' [ 18.808152][ T24] audit: type=1400 audit(1783162579.029:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.835334][ T24] audit: type=1400 audit(1783162579.059:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.835457][ T293] cgroup: Unknown subsys name 'devices' [ 18.959049][ T293] cgroup: Unknown subsys name 'hugetlb' [ 18.964627][ T293] cgroup: Unknown subsys name 'rlimit' [ 19.105941][ T24] audit: type=1400 audit(1783162579.349:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.129121][ T24] audit: type=1400 audit(1783162579.349:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 19.134231][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 19.149571][ T24] audit: type=1400 audit(1783162579.349:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 19.178469][ T24] audit: type=1400 audit(1783162579.349:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 19.203148][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.576223][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 19.586410][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 19.924688][ T329] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.931963][ T329] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.939301][ T329] device bridge_slave_0 entered promiscuous mode [ 19.945967][ T329] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.953002][ T329] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.960230][ T329] device bridge_slave_1 entered promiscuous mode [ 19.991334][ T329] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.998365][ T329] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.005585][ T329] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.012622][ T329] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.027323][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.035111][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.042620][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.058334][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.066529][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.074690][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.081711][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.089097][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.097181][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.104199][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.111475][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.119341][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.129813][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.137768][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.145119][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.153285][ T329] device veth0_vlan entered promiscuous mode [ 20.162930][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.172168][ T329] device veth1_macvtap entered promiscuous mode [ 20.180773][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.196600][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/04 10:56:20 executed programs: 0 [ 20.624690][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.631901][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.639266][ T365] device bridge_slave_0 entered promiscuous mode [ 20.650166][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.657183][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.664465][ T365] device bridge_slave_1 entered promiscuous mode [ 20.694261][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.701309][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.708571][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.715578][ T365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.731886][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.739304][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.746379][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.754896][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.763036][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.770058][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.781623][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.789895][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.796897][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.807148][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 20.815261][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.824225][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 20.832365][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.847090][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.855359][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.865355][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.873338][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.881686][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.889326][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.897408][ T365] device veth0_vlan entered promiscuous mode [ 20.910338][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.918486][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.927083][ T365] device veth1_macvtap entered promiscuous mode [ 20.935425][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.943088][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.951371][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.960330][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.968613][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.991710][ T369] ================================================================== [ 20.999799][ T369] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 21.006447][ T369] Write of size 8 at addr ffff888110bd8150 by task syz.2.17/369 [ 21.014045][ T369] [ 21.016359][ T369] CPU: 1 PID: 369 Comm: syz.2.17 Not tainted syzkaller #0 [ 21.023437][ T369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 21.033466][ T369] Call Trace: [ 21.036738][ T369] __dump_stack+0x21/0x24 [ 21.041043][ T369] dump_stack_lvl+0x1a7/0x208 [ 21.045695][ T369] ? show_regs_print_info+0x18/0x18 [ 21.050871][ T369] ? thaw_kernel_threads+0x220/0x220 [ 21.056132][ T369] ? debug_smp_processor_id+0x17/0x20 [ 21.061480][ T369] print_address_description+0x7f/0x2c0 [ 21.067005][ T369] ? mutex_lock+0x85/0xf0 [ 21.071321][ T369] kasan_report+0x100/0x140 [ 21.076621][ T369] ? mutex_lock+0x85/0xf0 [ 21.080937][ T369] kasan_check_range+0x249/0x2a0 [ 21.085849][ T369] __kasan_check_write+0x14/0x20 [ 21.090759][ T369] mutex_lock+0x85/0xf0 [ 21.094897][ T369] ? mutex_trylock+0xb0/0xb0 [ 21.099460][ T369] ? l2tp_session_put+0xb2/0x1a0 [ 21.104370][ T369] ? l2tp_session_delete+0x3a9/0x4a0 [ 21.109626][ T369] pppol2tp_release+0x178/0x2b0 [ 21.114450][ T369] sock_close+0xb8/0x200 [ 21.118665][ T369] ? sock_mmap+0xa0/0xa0 [ 21.122880][ T369] __fput+0x2dc/0x730 [ 21.126838][ T369] ____fput+0x15/0x20 [ 21.130797][ T369] task_work_run+0x127/0x190 [ 21.135362][ T369] exit_to_user_mode_loop+0xcb/0xe0 [ 21.140531][ T369] exit_to_user_mode_prepare+0x76/0xa0 [ 21.145968][ T369] syscall_exit_to_user_mode+0x1d/0x40 [ 21.151403][ T369] do_syscall_64+0x3d/0x40 [ 21.155792][ T369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.161661][ T369] RIP: 0033:0x7f70fab05e59 [ 21.166057][ T369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 21.185647][ T369] RSP: 002b:00007ffd47881268 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 21.194039][ T369] RAX: 0000000000000000 RBX: 00007ffd47881350 RCX: 00007f70fab05e59 [ 21.201992][ T369] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 21.209939][ T369] RBP: 00000000000051ec R08: 0000000000000001 R09: 0000000000000000 [ 21.217887][ T369] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 21.225836][ T369] R13: 00007f70fad8dfac R14: 00007f70fad8dfa8 R15: 00007f70fad8dfa0 [ 21.233784][ T369] [ 21.236088][ T369] Allocated by task 369: [ 21.240309][ T369] __kasan_kmalloc+0xd4/0x100 [ 21.244961][ T369] __kmalloc+0x19f/0x330 [ 21.249178][ T369] l2tp_session_create+0x39/0xb60 [ 21.254175][ T369] pppol2tp_connect+0xbf5/0x1640 [ 21.259086][ T369] __sys_connect+0x3ce/0x450 [ 21.263647][ T369] __x64_sys_connect+0x7a/0x90 [ 21.268395][ T369] do_syscall_64+0x31/0x40 [ 21.272789][ T369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.278653][ T369] [ 21.280959][ T369] Freed by task 369: [ 21.284829][ T369] kasan_set_track+0x4a/0x70 [ 21.289395][ T369] kasan_set_free_info+0x23/0x40 [ 21.294305][ T369] ____kasan_slab_free+0x125/0x160 [ 21.299390][ T369] __kasan_slab_free+0x11/0x20 [ 21.304140][ T369] slab_free_freelist_hook+0xc5/0x190 [ 21.309489][ T369] kfree+0xc0/0x270 [ 21.313275][ T369] l2tp_session_put+0xb2/0x1a0 [ 21.318014][ T369] l2tp_session_delete+0x3a9/0x4a0 [ 21.323099][ T369] pppol2tp_release+0x169/0x2b0 [ 21.327925][ T369] sock_close+0xb8/0x200 [ 21.332143][ T369] __fput+0x2dc/0x730 [ 21.336101][ T369] ____fput+0x15/0x20 [ 21.340059][ T369] task_work_run+0x127/0x190 [ 21.344622][ T369] exit_to_user_mode_loop+0xcb/0xe0 [ 21.349796][ T369] exit_to_user_mode_prepare+0x76/0xa0 [ 21.355227][ T369] syscall_exit_to_user_mode+0x1d/0x40 [ 21.360660][ T369] do_syscall_64+0x3d/0x40 [ 21.365049][ T369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.371355][ T369] [ 21.373664][ T369] The buggy address belongs to the object at ffff888110bd8000 [ 21.373664][ T369] which belongs to the cache kmalloc-512 of size 512 [ 21.387687][ T369] The buggy address is located 336 bytes inside of [ 21.387687][ T369] 512-byte region [ffff888110bd8000, ffff888110bd8200) [ 21.400929][ T369] The buggy address belongs to the page: [ 21.406555][ T369] page:ffffea000442f600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110bd8 [ 21.416760][ T369] head:ffffea000442f600 order:2 compound_mapcount:0 compound_pincount:0 [ 21.425061][ T369] flags: 0x4000000000010200(slab|head) [ 21.430497][ T369] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 21.439143][ T369] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 21.447702][ T369] page dumped because: kasan: bad access detected [ 21.454089][ T369] page_owner tracks the page as allocated [ 21.459790][ T369] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 365, ts 20983823839, free_ts 20951184886 [ 21.480156][ T369] prep_new_page+0x176/0x190 [ 21.484720][ T369] get_page_from_freelist+0x225f/0x23f0 [ 21.490237][ T369] __alloc_pages_nodemask+0x29a/0x640 [ 21.495585][ T369] new_slab+0x84/0x3f0 [ 21.499628][ T369] ___slab_alloc+0x2f8/0x4c0 [ 21.504188][ T369] __slab_alloc+0x63/0xa0 [ 21.508490][ T369] __kmalloc+0x1f9/0x330 [ 21.512707][ T369] fib6_info_alloc+0x34/0xe0 [ 21.517271][ T369] ip6_route_info_create+0x4c7/0x1450 [ 21.522614][ T369] ip6_route_add+0x27/0x130 [ 21.527092][ T369] addrconf_prefix_route+0x233/0x310 [ 21.532349][ T369] inet6_addr_add+0x51d/0x970 [ 21.536997][ T369] inet6_rtm_newaddr+0x6e1/0x9c0 [ 21.541910][ T369] rtnetlink_rcv_msg+0x9e9/0xca0 [ 21.546821][ T369] netlink_rcv_skb+0x1e9/0x430 [ 21.551558][ T369] rtnetlink_rcv+0x1c/0x20 [ 21.555945][ T369] page last free stack trace: [ 21.560598][ T369] __free_pages_ok+0x80b/0x830 [ 21.565334][ T369] __free_pages+0xd8/0x390 [ 21.569722][ T369] __free_slab+0xcf/0x190 [ 21.574023][ T369] unfreeze_partials+0x150/0x180 [ 21.578936][ T369] put_cpu_partial+0xc1/0x180 [ 21.583584][ T369] __slab_free+0x2c9/0x3a0 [ 21.587975][ T369] ___cache_free+0x10e/0x130 [ 21.592540][ T369] qlink_free+0x50/0x90 [ 21.596669][ T369] qlist_free_all+0x5f/0xb0 [ 21.601148][ T369] kasan_quarantine_reduce+0x14a/0x160 [ 21.606577][ T369] __kasan_slab_alloc+0x2f/0xe0 [ 21.611401][ T369] slab_post_alloc_hook+0x5d/0x2f0 [ 21.616484][ T369] __kmalloc+0x17b/0x330 [ 21.620701][ T369] fib6_info_alloc+0x34/0xe0 [ 21.625267][ T369] ip6_route_info_create+0x4c7/0x1450 [ 21.630608][ T369] ip6_route_add+0x27/0x130 [ 21.635080][ T369] [ 21.637382][ T369] Memory state around the buggy address: [ 21.642987][ T369] ffff888110bd8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.651029][ T369] ffff888110bd8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.659066][ T369] >ffff888110bd8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.667099][ T369] ^ [ 21.673744][ T369] ffff888110bd8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.681782][ T369] ffff888110bd8200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.689813][ T369] ================================================================== [ 21.697847][ T369] Disabling lock debugging due to kernel taint [ 21.749242][ T49] device bridge_slave_1 left promiscuous mode [ 21.755382][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.762942][ T49] device bridge_slave_0 left promiscuous mode [ 21.770075][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.778071][ T49] device veth1_macvtap left promiscuous mode [ 21.784062][ T49] device veth0_vlan left promiscuous mode