bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
==================================================================
BUG: KASAN: global-out-of-bounds in fib6_clean_node+0x35d/0x590 net/ipv6/ip6_fib.c:2251
Read of size 8 at addr ffffffff99f83568 by task kworker/u8:4/59

CPU: 0 UID: 0 PID: 59 Comm: kworker/u8:4 Not tainted 6.15.0-syzkaller-10820-gcd2e103d57e5 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xd2/0x2b0 mm/kasan/report.c:521
 kasan_report+0x118/0x150 mm/kasan/report.c:634
 fib6_clean_node+0x35d/0x590 net/ipv6/ip6_fib.c:2251
 fib6_walk_continue+0x67b/0x910 net/ipv6/ip6_fib.c:2177
 fib6_walk+0x149/0x290 net/ipv6/ip6_fib.c:2225
 fib6_clean_tree net/ipv6/ip6_fib.c:2305 [inline]
 __fib6_clean_all+0x234/0x380 net/ipv6/ip6_fib.c:2321
 rt6_sync_down_dev net/ipv6/route.c:5004 [inline]
 rt6_disable_ip+0x120/0x720 net/ipv6/route.c:5009
 addrconf_ifdown+0x15d/0x1880 net/ipv6/addrconf.c:3857
 addrconf_notify+0x1bc/0x1010 net/ipv6/addrconf.c:-1
 notifier_call_chain+0x1b6/0x3e0 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
 call_netdevice_notifiers net/core/dev.c:2282 [inline]
 dev_close_many+0x29c/0x410 net/core/dev.c:1785
 unregister_netdevice_many_notify+0x834/0x2320 net/core/dev.c:12046
 ops_exit_rtnl_list net/core/net_namespace.c:188 [inline]
 ops_undo_list+0x3dc/0x990 net/core/net_namespace.c:249
 cleanup_net+0x4c5/0x800 net/core/net_namespace.c:686
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
 kthread+0x711/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

The buggy address belongs to the variable:
 binder_devices+0x8/0x20

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x19f83
flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002000 ffffea000067e0c8 ffffea000067e0c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffffffff99f83400: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 ffffffff99f83480: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
>ffffffff99f83500: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
                                                          ^
 ffffffff99f83580: 00 00 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff99f83600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================