Warning: Permanently added '10.128.0.221' (ED25519) to the list of known hosts. 2026/04/08 18:09:52 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 44.827382][ T30] audit: type=1400 audit(1775671793.119:105): avc: denied { unlink } for pid=387 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 44.870409][ T387] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 45.619311][ T423] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.626356][ T423] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.634293][ T423] device bridge_slave_0 entered promiscuous mode [ 45.641904][ T423] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.649226][ T423] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.656660][ T423] device bridge_slave_1 entered promiscuous mode [ 45.693511][ T423] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.700852][ T423] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.708160][ T423] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.715176][ T423] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.731864][ T362] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.739274][ T362] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.746652][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 45.754646][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.770032][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.778577][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.786379][ T362] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.793873][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.802193][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.809536][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.822709][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.830805][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 45.841547][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 45.852333][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 45.860538][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 45.868117][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 45.876256][ T423] device veth0_vlan entered promiscuous mode [ 45.885418][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 45.894612][ T423] device veth1_macvtap entered promiscuous mode [ 45.903958][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 45.913854][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 45.958267][ T30] audit: type=1401 audit(1775671794.249:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 46.073177][ T30] audit: type=1400 audit(1775671794.359:107): avc: denied { create } for pid=440 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 2026/04/08 18:09:54 executed programs: 0 [ 46.320719][ T453] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.327875][ T453] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.335275][ T453] device bridge_slave_0 entered promiscuous mode [ 46.342636][ T453] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.349996][ T453] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.357539][ T453] device bridge_slave_1 entered promiscuous mode [ 46.404973][ T453] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.412168][ T453] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.419609][ T453] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.426728][ T453] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.443333][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 46.451449][ T362] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.458908][ T362] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.472999][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 46.481359][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.488498][ T362] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.497448][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 46.505894][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.512941][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.524419][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 46.537915][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.550406][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 46.561146][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 46.569196][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 46.576556][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 46.588023][ T453] device veth0_vlan entered promiscuous mode [ 46.597515][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 46.606740][ T453] device veth1_macvtap entered promiscuous mode [ 46.615656][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 46.624093][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 46.633633][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 46.642131][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 46.670467][ T30] audit: type=1400 audit(1775671794.959:108): avc: denied { prog_load } for pid=457 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 46.702302][ T30] audit: type=1400 audit(1775671794.979:109): avc: denied { bpf } for pid=457 comm="syz.2.17" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 46.733522][ T30] audit: type=1400 audit(1775671795.019:110): avc: denied { setopt } for pid=457 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 46.813062][ T30] audit: type=1400 audit(1775671795.099:111): avc: denied { perfmon } for pid=457 comm="syz.2.17" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 46.836486][ T30] audit: type=1400 audit(1775671795.119:112): avc: denied { prog_run } for pid=457 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 46.860982][ T461] ================================================================== [ 46.869159][ T461] BUG: KASAN: slab-out-of-bounds in l2cap_sock_setsockopt+0x1a1f/0x1df0 [ 46.877586][ T461] Read of size 4 at addr ffff8881065b5be3 by task syz.2.18/461 [ 46.885112][ T461] [ 46.887422][ T461] CPU: 0 PID: 461 Comm: syz.2.18 Not tainted syzkaller #0 [ 46.894507][ T461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 46.904551][ T461] Call Trace: [ 46.907814][ T461] [ 46.910814][ T461] __dump_stack+0x21/0x30 [ 46.915128][ T461] dump_stack_lvl+0x110/0x170 [ 46.919959][ T461] ? show_regs_print_info+0x20/0x20 [ 46.925146][ T461] ? load_image+0x3e0/0x3e0 [ 46.929624][ T461] ? lock_sock_nested+0x21c/0x2a0 [ 46.934797][ T461] print_address_description+0x7f/0x2c0 [ 46.940339][ T461] ? l2cap_sock_setsockopt+0x1a1f/0x1df0 [ 46.945955][ T461] kasan_report+0xf1/0x140 [ 46.950809][ T461] ? memcpy+0x56/0x70 [ 46.954790][ T461] ? l2cap_sock_setsockopt+0x1a1f/0x1df0 [ 46.960497][ T461] __asan_report_load_n_noabort+0xf/0x20 [ 46.966211][ T461] l2cap_sock_setsockopt+0x1a1f/0x1df0 [ 46.971654][ T461] ? selinux_socket_setsockopt+0x282/0x360 [ 46.977449][ T461] ? __cgroup_bpf_run_filter_sysctl+0x760/0x760 [ 46.983759][ T461] ? l2cap_sock_shutdown+0xba0/0xba0 [ 46.989050][ T461] ? __fget_files+0x2c4/0x320 [ 46.993709][ T461] ? security_socket_setsockopt+0x82/0xa0 [ 46.999409][ T461] ? l2cap_sock_shutdown+0xba0/0xba0 [ 47.004674][ T461] __sys_setsockopt+0x2e9/0x470 [ 47.009511][ T461] ? __ia32_sys_recv+0xb0/0xb0 [ 47.014354][ T461] ? __kasan_check_write+0x14/0x20 [ 47.019544][ T461] __x64_sys_setsockopt+0xbf/0xd0 [ 47.024561][ T461] x64_sys_call+0x982/0x9a0 [ 47.029229][ T461] do_syscall_64+0x4c/0xa0 [ 47.033632][ T461] ? clear_bhb_loop+0x50/0xa0 [ 47.038376][ T461] ? clear_bhb_loop+0x50/0xa0 [ 47.043042][ T461] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 47.049003][ T461] RIP: 0033:0x7fd07be3bef9 [ 47.053495][ T461] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.073365][ T461] RSP: 002b:00007fd07bca0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 47.081783][ T461] RAX: ffffffffffffffda RBX: 00007fd07c0a6fa0 RCX: 00007fd07be3bef9 [ 47.090004][ T461] RDX: 0000000000000008 RSI: 0000000000000112 RDI: 0000000000000004 [ 47.097965][ T461] RBP: 00007fd07bed0ee0 R08: 0000000000000001 R09: 0000000000000000 [ 47.106023][ T461] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000 [ 47.113986][ T461] R13: 00007fd07c0a7038 R14: 00007fd07c0a6fa0 R15: 00007ffcf55e54e8 [ 47.122049][ T461] [ 47.125053][ T461] [ 47.127369][ T461] Allocated by task 461: [ 47.131690][ T461] __kasan_kmalloc+0xda/0x110 [ 47.136354][ T461] __kmalloc+0x13d/0x2c0 [ 47.140581][ T461] __cgroup_bpf_run_filter_setsockopt+0x8e7/0xaa0 [ 47.146980][ T461] __sys_setsockopt+0x40e/0x470 [ 47.151814][ T461] __x64_sys_setsockopt+0xbf/0xd0 [ 47.156828][ T461] x64_sys_call+0x982/0x9a0 [ 47.161320][ T461] do_syscall_64+0x4c/0xa0 [ 47.165726][ T461] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 47.171701][ T461] [ 47.174518][ T461] The buggy address belongs to the object at ffff8881065b5be0 [ 47.174518][ T461] which belongs to the cache kmalloc-8 of size 8 [ 47.188471][ T461] The buggy address is located 3 bytes inside of [ 47.188471][ T461] 8-byte region [ffff8881065b5be0, ffff8881065b5be8) [ 47.201427][ T461] The buggy address belongs to the page: [ 47.207060][ T461] page:ffffea0004196d40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1065b5 [ 47.217378][ T461] flags: 0x4000000000000200(slab|zone=1) [ 47.223021][ T461] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888100042300 [ 47.231602][ T461] raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 [ 47.240294][ T461] page dumped because: kasan: bad access detected [ 47.246709][ T461] page_owner tracks the page as allocated [ 47.252429][ T461] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 1336103711, free_ts 1317949967 [ 47.268075][ T461] post_alloc_hook+0x192/0x1b0 [ 47.272835][ T461] prep_new_page+0x1c/0x110 [ 47.277319][ T461] get_page_from_freelist+0x2d3a/0x2dc0 [ 47.282846][ T461] __alloc_pages+0x1a2/0x460 [ 47.287427][ T461] new_slab+0xa1/0x4d0 [ 47.291540][ T461] ___slab_alloc+0x381/0x810 [ 47.296126][ T461] __slab_alloc+0x49/0x90 [ 47.300522][ T461] __kmalloc+0x16a/0x2c0 [ 47.304745][ T461] acpi_ns_internalize_name+0x2c8/0x3b0 [ 47.310357][ T461] acpi_ns_get_node+0x1a7/0x360 [ 47.315210][ T461] acpi_get_handle+0x18a/0x290 [ 47.320041][ T461] acpi_has_method+0x89/0xe0 [ 47.324703][ T461] acpi_bay_match+0x7e/0x1e0 [ 47.329280][ T461] acpi_bus_check_add+0x48e/0x790 [ 47.334308][ T461] acpi_bus_check_add_1+0x22/0x30 [ 47.339490][ T461] acpi_ns_walk_namespace+0x218/0x680 [ 47.344944][ T461] page last free stack trace: [ 47.349639][ T461] free_unref_page_prepare+0x542/0x550 [ 47.355088][ T461] free_unref_page+0xae/0x540 [ 47.359758][ T461] __free_pages+0x6c/0x100 [ 47.364196][ T461] __free_slab+0xe8/0x1e0 [ 47.368514][ T461] __unfreeze_partials+0x160/0x190 [ 47.373961][ T461] flush_cpu_slab+0x10a/0x1b0 [ 47.378707][ T461] process_one_work+0x6be/0xba0 [ 47.383758][ T461] worker_thread+0xd84/0x1200 [ 47.388538][ T461] kthread+0x411/0x500 [ 47.392586][ T461] ret_from_fork+0x1f/0x30 [ 47.397074][ T461] [ 47.399378][ T461] Memory state around the buggy address: [ 47.405073][ T461] ffff8881065b5a80: fc fc fc fc fb fc fc fc fc fa fc fc fc fc 00 fc [ 47.413111][ T461] ffff8881065b5b00: fc fc fc 05 fc fc fc fc 05 fc fc fc fc fa fc fc [ 47.421154][ T461] >ffff8881065b5b80: fc fc fb fc fc fc fc fa fc fc fc fc 01 fc fc fc [ 47.429197][ T461] ^ [ 47.436368][ T461] ffff8881065b5c00: fc fa fc fc fc fc fb fc fc fc fc fb fc fc fc fc [ 47.444403][ T461] ffff8881065b5c80: fb fc fc fc fc fa fc fc fc fc 05 fc fc fc fc 04 [ 47.452499][ T461] ================================================================== [ 47.460623][ T461] Disabling lock debugging due to kernel taint [ 47.474406][ T30] audit: type=1400 audit(1775671795.759:113): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 47.496512][ T30] audit: type=1400 audit(1775671795.759:114): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 48.028518][ T278] device bridge_slave_1 left promiscuous mode [ 48.035175][ T278] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.047466][ T278] device bridge_slave_0 left promiscuous mode [ 48.053708][ T278] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.061974][ T278] device veth1_macvtap left promiscuous mode [ 48.069060][ T278] device veth0_vlan left promiscuous mode 2026/04/08 18:09:59 executed programs: 228 2026/04/08 18:10:04 executed programs: 528