Warning: Permanently added '10.128.0.215' (ED25519) to the list of known hosts. 2026/08/08 16:14:22 parsed 1 programs 2026/08/08 16:14:22 serving rpc on tcp://41249 Setting up swapspace version 1, size = 127995904 bytes [ 39.463970][ T23] kauditd_printk_skb: 35 callbacks suppressed [ 39.463976][ T23] audit: type=1400 audit(1786205662.179:109): avc: denied { unlink } for pid=417 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 39.505808][ T417] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 39.880112][ T433] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.887391][ T433] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.895706][ T433] device bridge_slave_0 entered promiscuous mode [ 39.904727][ T433] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.912077][ T433] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.919882][ T433] device bridge_slave_1 entered promiscuous mode [ 39.946085][ T433] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.953145][ T433] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.960353][ T433] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.967466][ T433] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.980576][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.987820][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.995267][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 40.002588][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 40.012337][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 40.020638][ T308] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.027674][ T308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.035888][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 40.044031][ T308] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.051120][ T308] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.061788][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 40.070745][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 40.082091][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 40.092529][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 40.100901][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 40.108651][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 40.118961][ T433] device veth0_vlan entered promiscuous mode [ 40.127408][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 40.136121][ T433] device veth1_macvtap entered promiscuous mode [ 40.144572][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 40.154663][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 40.319313][ T23] audit: type=1401 audit(1786205663.029:110): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" 2026/08/08 16:14:23 executed programs: 0 [ 40.558020][ T470] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.565447][ T470] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.573250][ T470] device bridge_slave_0 entered promiscuous mode [ 40.580591][ T470] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.587880][ T470] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.595302][ T470] device bridge_slave_1 entered promiscuous mode [ 40.622247][ T470] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.629482][ T470] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.636724][ T470] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.643873][ T470] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.657881][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 40.665364][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.672490][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.680905][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 40.689722][ T308] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.696763][ T308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.709052][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 40.717353][ T308] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.724421][ T308] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.734693][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 40.744396][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 40.760662][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 40.771096][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 40.779216][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 40.786771][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 40.795376][ T470] device veth0_vlan entered promiscuous mode [ 40.807586][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 40.816481][ T470] device veth1_macvtap entered promiscuous mode [ 40.824860][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 40.837566][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 40.858486][ T23] audit: type=1400 audit(1786205663.569:111): avc: denied { create } for pid=474 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 40.878295][ T23] audit: type=1400 audit(1786205663.569:112): avc: denied { connect } for pid=474 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 40.883364][ T474] ================================================================== [ 40.898570][ T23] audit: type=1400 audit(1786205663.569:113): avc: denied { ioctl } for pid=474 comm="syz.2.17" path="socket:[13179]" dev="sockfs" ino=13179 ioctlcmd=0x942e scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 40.905923][ T474] BUG: KASAN: use-after-free in mutex_lock+0x6b/0xd0 [ 40.905940][ T474] Write of size 8 at addr ffff888113a8b550 by task syz.2.17/474 [ 40.905941][ T474] [ 40.905948][ T474] CPU: 0 PID: 474 Comm: syz.2.17 Not tainted syzkaller #0 [ 40.905950][ T474] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 40.905960][ T474] Call Trace: [ 40.905967][ T474] dump_stack_lvl+0x81/0xac [ 40.905974][ T474] print_address_description.constprop.0+0x24/0x160 [ 40.905977][ T474] ? mutex_lock+0x6b/0xd0 [ 40.905980][ T474] kasan_report.cold+0x82/0xdb [ 40.905983][ T474] ? mutex_lock+0x6b/0xd0 [ 40.905988][ T474] kasan_check_range+0x148/0x190 [ 40.905990][ T474] __kasan_check_write+0x14/0x20 [ 40.905993][ T474] mutex_lock+0x6b/0xd0 [ 40.905996][ T474] ? __mutex_lock_slowpath+0x10/0x10 [ 40.906002][ T474] ? l2tp_session_put+0x7d/0x130 [ 40.906006][ T474] ? l2tp_session_delete+0x1c8/0x440 [ 40.906010][ T474] pppol2tp_release+0x21a/0x3e0 [ 40.906015][ T474] __sock_release+0xc2/0x270 [ 40.906019][ T474] sock_close+0x10/0x20 [ 40.906023][ T474] __fput+0x237/0x760 [ 40.906027][ T474] ____fput+0x9/0x10 [ 40.906032][ T474] task_work_run+0xc2/0x140 [ 40.906039][ T474] exit_to_user_mode_prepare+0x150/0x160 [ 40.906044][ T474] syscall_exit_to_user_mode+0x27/0x160 [ 40.906053][ T474] do_syscall_64+0x3f/0x50 [ 41.064747][ T474] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 41.070615][ T474] RIP: 0033:0x7fbd39ad7e59 [ 41.075008][ T474] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.094793][ T474] RSP: 002b:00007ffdfe728da8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 41.103274][ T474] RAX: 0000000000000000 RBX: 00007ffdfe728e90 RCX: 00007fbd39ad7e59 [ 41.111325][ T474] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 41.119291][ T474] RBP: 0000000000009f82 R08: 0000000000000001 R09: 0000000000000000 [ 41.127239][ T474] R10: 0000001b31520000 R11: 0000000000000246 R12: 00007ffdfe728ed0 [ 41.135282][ T474] R13: 00007fbd39d50fac R14: 0000000000009fb5 R15: 00007fbd39d50fa0 [ 41.143545][ T474] [ 41.145850][ T474] Allocated by task 475: [ 41.150106][ T474] kasan_save_stack+0x26/0x50 [ 41.154749][ T474] __kasan_kmalloc+0xae/0xe0 [ 41.159490][ T474] __kmalloc+0x1cd/0x360 [ 41.163704][ T474] l2tp_session_create+0x38/0xa80 [ 41.168853][ T474] pppol2tp_connect+0xe03/0x19c0 [ 41.174073][ T474] __sys_connect_file+0x136/0x190 [ 41.179197][ T474] __sys_connect+0x101/0x130 [ 41.183850][ T474] __x64_sys_connect+0x6e/0xb0 [ 41.188843][ T474] do_syscall_64+0x32/0x50 [ 41.193233][ T474] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 41.199270][ T474] [ 41.201570][ T474] Freed by task 474: [ 41.205447][ T474] kasan_save_stack+0x26/0x50 [ 41.210217][ T474] kasan_set_track+0x25/0x30 [ 41.214867][ T474] kasan_set_free_info+0x24/0x40 [ 41.219858][ T474] __kasan_slab_free+0x111/0x150 [ 41.224851][ T474] slab_free_freelist_hook+0x9b/0x1a0 [ 41.230244][ T474] kfree+0xc2/0x4e0 [ 41.234031][ T474] l2tp_session_put+0x7d/0x130 [ 41.238769][ T474] l2tp_session_delete+0x1c8/0x440 [ 41.243937][ T474] pppol2tp_release+0x212/0x3e0 [ 41.248843][ T474] __sock_release+0xc2/0x270 [ 41.253435][ T474] sock_close+0x10/0x20 [ 41.257561][ T474] __fput+0x237/0x760 [ 41.261509][ T474] ____fput+0x9/0x10 [ 41.265394][ T474] task_work_run+0xc2/0x140 [ 41.269957][ T474] exit_to_user_mode_prepare+0x150/0x160 [ 41.275829][ T474] syscall_exit_to_user_mode+0x27/0x160 [ 41.281343][ T474] do_syscall_64+0x3f/0x50 [ 41.285754][ T474] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 41.291891][ T474] [ 41.294277][ T474] The buggy address belongs to the object at ffff888113a8b400 [ 41.294277][ T474] which belongs to the cache kmalloc-512 of size 512 [ 41.308501][ T474] The buggy address is located 336 bytes inside of [ 41.308501][ T474] 512-byte region [ffff888113a8b400, ffff888113a8b600) [ 41.321779][ T474] The buggy address belongs to the page: [ 41.327431][ T474] page:ffffea00044ea200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113a88 [ 41.337908][ T474] head:ffffea00044ea200 order:2 compound_mapcount:0 compound_pincount:0 [ 41.346324][ T474] flags: 0x4000000000010200(slab|head) [ 41.351853][ T474] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 41.360599][ T474] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 41.369159][ T474] page dumped because: kasan: bad access detected [ 41.375573][ T474] page_owner tracks the page as allocated [ 41.381270][ T474] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 319, ts 40849098613, free_ts 40848210613 [ 41.399689][ T474] get_page_from_freelist+0x1fee/0x2ad0 [ 41.405319][ T474] __alloc_pages_nodemask+0x2ae/0x2540 [ 41.410853][ T474] allocate_slab+0x30f/0x460 [ 41.415414][ T474] ___slab_alloc.constprop.0+0x32b/0x730 [ 41.421206][ T474] __kmalloc+0x32d/0x360 [ 41.425450][ T474] ___neigh_create+0xc5f/0x1be0 [ 41.430443][ T474] __neigh_create+0x12/0x20 [ 41.435013][ T474] ip6_finish_output2+0xceb/0x1960 [ 41.440112][ T474] __ip6_finish_output.part.0+0x272/0x7b0 [ 41.445824][ T474] ip6_finish_output+0x1cb/0x340 [ 41.450727][ T474] ip6_output+0x1d0/0x440 [ 41.455030][ T474] ip6_local_out+0x6a/0x90 [ 41.459422][ T474] udp_tunnel6_xmit_skb+0x5f1/0xb60 [ 41.464675][ T474] send6+0x425/0xa20 [ 41.468539][ T474] wg_socket_send_skb_to_peer+0xc7/0x1d0 [ 41.474138][ T474] wg_socket_send_buffer_to_peer+0x12e/0x190 [ 41.480100][ T474] page last free stack trace: [ 41.484746][ T474] __free_pages_ok+0x44b/0x840 [ 41.489475][ T474] __free_pages+0xda/0xf0 [ 41.493773][ T474] __free_slab+0xde/0x1d0 [ 41.498163][ T474] discard_slab+0x2b/0x40 [ 41.502460][ T474] unfreeze_partials+0x1e1/0x240 [ 41.507364][ T474] put_cpu_partial+0xce/0x120 [ 41.512033][ T474] __slab_free+0x23f/0x560 [ 41.516503][ T474] ___cache_free+0x255/0x2b0 [ 41.521063][ T474] qlist_free_all+0x71/0x150 [ 41.525625][ T474] kasan_quarantine_reduce+0x15f/0x1c0 [ 41.531141][ T474] __kasan_slab_alloc+0xaa/0xc0 [ 41.535964][ T474] kmem_cache_alloc+0x39f/0x4f0 [ 41.540924][ T474] sock_alloc_inode+0x17/0x1b0 [ 41.545672][ T474] alloc_inode+0x5c/0x1e0 [ 41.550064][ T474] new_inode_pseudo+0xe/0xd0 [ 41.554662][ T474] sock_alloc+0x3c/0x270 [ 41.558900][ T474] [ 41.561200][ T474] Memory state around the buggy address: [ 41.566800][ T474] ffff888113a8b400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.574923][ T474] ffff888113a8b480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.582963][ T474] >ffff888113a8b500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.591346][ T474] ^ [ 41.597995][ T474] ffff888113a8b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.606029][ T474] ffff888113a8b600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.614498][ T474] ================================================================== [ 41.622620][ T474] Disabling lock debugging due to kernel taint [ 41.633443][ T23] audit: type=1400 audit(1786205664.339:114): avc: denied { read } for pid=73 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 41.655640][ T23] audit: type=1400 audit(1786205664.339:115): avc: denied { search } for pid=73 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.677731][ T23] audit: type=1400 audit(1786205664.339:116): avc: denied { write } for pid=73 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.699111][ T23] audit: type=1400 audit(1786205664.339:117): avc: denied { add_name } for pid=73 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.720672][ T23] audit: type=1400 audit(1786205664.339:118): avc: denied { create } for pid=73 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 41.914441][ T9] device bridge_slave_1 left promiscuous mode [ 41.920587][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.928155][ T9] device bridge_slave_0 left promiscuous mode [ 41.935942][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.944319][ T9] device veth1_macvtap left promiscuous mode [ 41.950355][ T9] device veth0_vlan left promiscuous mode 2026/08/08 16:14:28 executed programs: 231 2026/08/08 16:14:33 executed programs: 531