ocess permissive=1 [ 14.475459][ T28] audit: type=1400 audit(1781193954.486:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.9' (ED25519) to the list of known hosts. 2026/06/11 16:06:04 parsed 1 programs [ 24.484160][ T28] audit: type=1400 audit(1781193964.506:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.504903][ T28] audit: type=1400 audit(1781193964.506:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.287115][ T28] audit: type=1400 audit(1781193965.306:66): avc: denied { mounton } for pid=302 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.288071][ T302] cgroup: Unknown subsys name 'net' [ 25.310048][ T28] audit: type=1400 audit(1781193965.306:67): avc: denied { mount } for pid=302 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.337601][ T28] audit: type=1400 audit(1781193965.346:68): avc: denied { unmount } for pid=302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.337750][ T302] cgroup: Unknown subsys name 'devices' [ 25.480167][ T302] cgroup: Unknown subsys name 'hugetlb' [ 25.485908][ T302] cgroup: Unknown subsys name 'rlimit' [ 25.593998][ T28] audit: type=1400 audit(1781193965.616:69): avc: denied { setattr } for pid=302 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.617197][ T28] audit: type=1400 audit(1781193965.616:70): avc: denied { create } for pid=302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.637736][ T28] audit: type=1400 audit(1781193965.616:71): avc: denied { write } for pid=302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.641101][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.658286][ T28] audit: type=1400 audit(1781193965.616:72): avc: denied { read } for pid=302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.687268][ T28] audit: type=1400 audit(1781193965.616:73): avc: denied { mounton } for pid=302 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.710413][ T302] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.422142][ T308] request_module fs-gadgetfs succeeded, but still no fs? [ 26.904393][ T350] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.911461][ T350] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.918857][ T350] device bridge_slave_0 entered promiscuous mode [ 26.925740][ T350] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.932810][ T350] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.940433][ T350] device bridge_slave_1 entered promiscuous mode [ 26.984530][ T350] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.991617][ T350] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.999026][ T350] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.006060][ T350] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.023647][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.031793][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.039342][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.048105][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.057078][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.064148][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.074803][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.083903][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.090985][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.102181][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.111383][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.124525][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.135484][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.143663][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.151985][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.160460][ T350] device veth0_vlan entered promiscuous mode [ 27.170489][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.179598][ T350] device veth1_macvtap entered promiscuous mode [ 27.188690][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.198934][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.227706][ T350] syz-executor (350) used greatest stack depth: 21312 bytes left 2026/06/11 16:06:07 executed programs: 0 [ 27.580581][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.587647][ T368] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.595357][ T368] device bridge_slave_0 entered promiscuous mode [ 27.607771][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.615028][ T368] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.622550][ T368] device bridge_slave_1 entered promiscuous mode [ 27.665858][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.672922][ T368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.680388][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.687496][ T368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.704585][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.712172][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.720297][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.737157][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.745384][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.752426][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.761555][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.769889][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.777000][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.789747][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.802715][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.810871][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.824102][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.832731][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.847477][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.855660][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.863752][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.871329][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.886397][ T368] device veth0_vlan entered promiscuous mode [ 27.896087][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.904872][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.914160][ T368] device veth1_macvtap entered promiscuous mode [ 27.923032][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.930840][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.939567][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.957564][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.968656][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.999061][ C0] ================================================================== [ 28.007197][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 28.014577][ C0] Read of size 8 at addr ffff88810cfccd90 by task ksoftirqd/0/13 [ 28.022650][ C0] [ 28.024976][ C0] CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted syzkaller #0 [ 28.032354][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 28.042404][ C0] Call Trace: [ 28.045675][ C0] [ 28.048603][ C0] __dump_stack+0x21/0x24 [ 28.052963][ C0] dump_stack_lvl+0x110/0x170 [ 28.057658][ C0] ? __cfi_dump_stack_lvl+0x8/0x8 [ 28.062701][ C0] ? debug_smp_processor_id+0x17/0x20 [ 28.068191][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 28.073236][ C0] print_address_description+0x71/0x200 [ 28.078975][ C0] print_report+0x4a/0x60 [ 28.083317][ C0] kasan_report+0x122/0x150 [ 28.087838][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 28.092878][ C0] __asan_report_load8_noabort+0x14/0x20 [ 28.098529][ C0] rcu_cblist_dequeue+0x6c/0xb0 [ 28.103400][ C0] rcu_do_batch+0x4bb/0xbc0 [ 28.107920][ C0] ? rcu_core+0xe80/0xe80 [ 28.112261][ C0] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 28.118117][ C0] ? rcu_report_qs_rnp+0x2bc/0x390 [ 28.123246][ C0] rcu_core+0x5c3/0xe80 [ 28.127463][ C0] ? rcu_cpu_kthread_park+0x90/0x90 [ 28.132684][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 28.138245][ C0] ? rcu_softirq_qs+0xd5/0x340 [ 28.143026][ C0] ? __cfi_rcu_softirq_qs+0x10/0x10 [ 28.148326][ C0] ? irqtime_account_irq+0x75/0x240 [ 28.153546][ C0] rcu_core_si+0x9/0x10 [ 28.157899][ C0] handle_softirqs+0x1d7/0x600 [ 28.162678][ C0] ? __cfi_run_ksoftirqd+0x10/0x10 [ 28.167805][ C0]