[ 26.746273][ T49] device bridge_slave_0 left promiscuous mode [ 26.752571][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.760950][ T49] device veth1_macvtap left promiscuous mode [ 26.767320][ T49] device veth0_vlan left promiscuous mode [ 28.251561][ T49] device bridge_slave_1 left promiscuous mode [ 28.258002][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.266586][ T49] device bridge_slave_0 left promiscuous mode [ 28.273722][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.282115][ T49] device veth1_macvtap left promiscuous mode [ 28.288673][ T49] device veth0_vlan left promiscuous mode Warning: Permanently added '10.128.1.239' (ED25519) to the list of known hosts. 2026/02/10 19:27:01 parsed 1 programs [ 45.472334][ T24] kauditd_printk_skb: 31 callbacks suppressed [ 45.472346][ T24] audit: type=1400 audit(1770751621.700:105): avc: denied { unlink } for pid=414 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 45.518760][ T414] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 45.955067][ T24] audit: type=1401 audit(1770751622.180:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 46.344189][ T24] audit: type=1400 audit(1770751622.570:107): avc: denied { create } for pid=442 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 46.499491][ T452] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.506841][ T452] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.514436][ T452] device bridge_slave_0 entered promiscuous mode [ 46.521769][ T452] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.529089][ T452] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.537162][ T452] device bridge_slave_1 entered promiscuous mode [ 46.571342][ T452] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.578748][ T452] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.586084][ T452] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.593279][ T452] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.615384][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.622797][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.630334][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 46.638207][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 46.653040][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 46.663138][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.670343][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.683177][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 46.691602][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.699266][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.712044][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 46.727458][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.739952][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 46.751248][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 46.759420][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 46.767256][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 46.775789][ T452] device veth0_vlan entered promiscuous mode [ 46.791631][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 46.800451][ T452] device veth1_macvtap entered promiscuous mode [ 46.809133][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 46.818979][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/02/10 19:27:03 executed programs: 0 [ 47.086639][ T24] audit: type=1400 audit(1770751623.310:108): avc: denied { write } for pid=405 comm="syz-execprog" path="pipe:[15406]" dev="pipefs" ino=15406 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 47.124981][ T478] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.132409][ T478] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.139970][ T478] device bridge_slave_0 entered promiscuous mode [ 47.147643][ T478] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.155270][ T478] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.162983][ T478] device bridge_slave_1 entered promiscuous mode [ 47.193287][ T478] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.200552][ T478] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.207977][ T478] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.215332][ T478] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.231805][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 47.239814][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.247982][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.256887][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 47.265935][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.273380][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.283405][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 47.291650][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.298860][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.310431][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 47.324586][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 47.339212][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 47.355080][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 47.364320][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 47.372187][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 47.383992][ T478] device veth0_vlan entered promiscuous mode [ 47.393985][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 47.403650][ T478] device veth1_macvtap entered promiscuous mode [ 47.413781][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 47.426699][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 47.450895][ T24] audit: type=1400 audit(1770751623.670:109): avc: denied { create } for pid=482 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 47.473278][ T24] audit: type=1400 audit(1770751623.690:110): avc: denied { write } for pid=482 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 47.495111][ T24] audit: type=1400 audit(1770751623.690:111): avc: denied { nlmsg_write } for pid=482 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 47.711805][ T305] device bridge_slave_1 left promiscuous mode [ 47.718479][ T305] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.726924][ T305] device bridge_slave_0 left promiscuous mode [ 47.742312][ T305] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.750876][ T305] device veth1_macvtap left promiscuous mode [ 47.757493][ T305] device veth0_vlan left promiscuous mode [ 47.861118][ C0] ================================================================== [ 47.870181][ C0] BUG: KASAN: stack-out-of-bounds in __xfrm_dst_hash+0x399/0x480 [ 47.878977][ C0] Read of size 4 at addr ffffc90000007b18 by task swapper/0/0 [ 47.886666][ C0] [ 47.889084][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 47.896441][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 47.907285][ C0] Call Trace: [ 47.910852][ C0] [ 47.913700][ C0] __dump_stack+0x21/0x24 [ 47.918036][ C0] dump_stack_lvl+0x1a7/0x208 [ 47.922810][ C0] ? show_regs_print_info+0x18/0x18 [ 47.928096][ C0] ? thaw_kernel_threads+0x220/0x220 [ 47.933565][ C0] print_address_description+0x7f/0x2c0 [ 47.939436][ C0] ? __xfrm_dst_hash+0x399/0x480 [ 47.944531][ C0] kasan_report+0xe2/0x130 [ 47.949245][ C0] ? __xfrm_dst_hash+0x399/0x480 [ 47.954216][ C0] __asan_report_load4_noabort+0x14/0x20 [ 47.960118][ C0] __xfrm_dst_hash+0x399/0x480 [ 47.966248][ C0] xfrm_state_find+0x28c/0x28b0 [ 47.971289][ C0] ? stack_trace_save+0xf0/0xf0 [ 47.976142][ C0] ? xfrm_sad_getinfo+0x170/0x170 [ 47.981322][ C0] ? stack_trace_save+0xa6/0xf0 [ 47.986839][ C0] ? stack_trace_snprint+0xf0/0xf0 [ 47.992642][ C0] xfrm_resolve_and_create_bundle+0x697/0x29f0 [ 47.999223][ C0] ? xfrm_sk_policy_lookup+0x480/0x480 [ 48.004683][ C0] ? xfrm_selector_match+0xb7e/0x1030 [ 48.010054][ C0] ? __xfrm_policy_check+0x29d0/0x29d0 [ 48.015773][ C0] xfrm_lookup_with_ifid+0x7ea/0x1a80 [ 48.022316][ C0] ? percpu_counter_add_batch+0x13c/0x160 [ 48.028063][ C0] ? rt_set_nexthop+0x5b9/0x780 [ 48.033160][ C0] ? __xfrm_sk_clone_policy+0x680/0x680 [ 48.038812][ C0] ? ip_route_output_key_hash_rcu+0x15af/0x20e0 [ 48.045046][ C0] xfrm_lookup_route+0x3c/0x170 [ 48.049885][ C0] ip_route_output_flow+0x1f8/0x2f0 [ 48.055085][ C0] ? igmpv3_newpack+0x173/0xc80 [ 48.060096][ C0] ? ipv4_sk_update_pmtu+0x14c0/0x14c0 [ 48.066511][ C0] ? make_kuid+0x1db/0x680 [ 48.070920][ C0] ? __put_user_ns+0x60/0x60 [ 48.075531][ C0] ? __kasan_check_write+0x14/0x20 [ 48.080633][ C0] ? __alloc_skb+0x38b/0x520 [ 48.085485][ C0] igmpv3_newpack+0x281/0xc80 [ 48.090168][ C0] ? igmpv3_sendpack+0x190/0x190 [ 48.095271][ C0] ? enqueue_task+0x176/0x1050 [ 48.100024][ C0] add_grhead+0x75/0x2e0 [ 48.104256][ C0] add_grec+0x116b/0x1410 [ 48.108576][ C0] ? __kasan_check_write+0x14/0x20 [ 48.114050][ C0] igmp_ifc_timer_expire+0x89e/0xf80 [ 48.119696][ C0] ? __kasan_check_write+0x14/0x20 [ 48.124991][ C0] ? _raw_spin_lock_irq+0x95/0xf0 [ 48.130285][ C0] ? _raw_spin_lock_irqsave+0x130/0x130 [ 48.136412][ C0] ? igmp_gq_timer_expire+0xe0/0xe0 [ 48.142426][ C0] call_timer_fn+0x38/0x290 [ 48.147140][ C0] ? igmp_gq_timer_expire+0xe0/0xe0 [ 48.153259][ C0] __run_timers+0x650/0x9e0 [ 48.158069][ C0] ? calc_index+0x200/0x200 [ 48.163432][ C0] ? sched_clock_cpu+0x1b/0x3d0 [ 48.168456][ C0] run_timer_softirq+0x6a/0xf0 [ 48.173303][ C0] __do_softirq+0x255/0x563 [ 48.178527][ C0] asm_call_irq_on_stack+0xf/0x20 [ 48.183573][ C0] [ 48.186705][ C0] do_softirq_own_stack+0x60/0x80 [ 48.191926][ C0] __irq_exit_rcu+0x128/0x150 [ 48.196620][ C0] irq_exit_rcu+0x9/0x10 [ 48.200981][ C0] sysvec_apic_timer_interrupt+0xbf/0xe0 [ 48.207388][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 48.213543][ C0] RIP: 0010:default_idle+0x12/0x20 [ 48.218760][ C0] Code: 44 2a 00 00 49 bd 00 00 00 00 00 fc ff df e9 67 ff ff ff e8 d0 f7 fa ff 55 48 89 e5 0f 1f 44 00 00 0f 00 2d d0 68 62 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56 [ 48.238989][ C0] RSP: 0018:ffffffff86407d58 EFLAGS: 00000252 [ 48.245246][ C0] RAX: ffff8881f7000000 RBX: ffffffff8641c100 RCX: 0000000000007f7e [ 48.253510][ C0] RDX: 0000000000000001 RSI: ffffffff85407fc0 RDI: ffffffff85407f80 [ 48.261771][ C0] RBP: ffffffff86407d58 R08: ffff8881f70573d3 R09: 1ffff1103ee0ae7a [ 48.269841][ C0] R10: dffffc0000000000 R11: ffffed103ee0ae7b R12: 1ffffffff0c83820 [ 48.278177][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: dffffc0000000000 [ 48.286257][ C0] arch_cpu_idle+0xa/0x10 [ 48.290679][ C0] default_idle_call+0x71/0x1d0 [ 48.295992][ C0] do_idle+0x1dc/0x570 [ 48.300199][ C0] ? rcu_irq_exit+0x9/0x10 [ 48.304899][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 48.310127][ C0] cpu_startup_entry+0x18/0x20 [ 48.315005][ C0] rest_init+0xe8/0xf0 [ 48.319305][ C0] ? time_init+0x38/0x38 [ 48.323646][ C0] arch_call_rest_init+0xe/0x10 [ 48.328668][ C0] start_kernel+0x431/0x49f [ 48.333366][ C0] x86_64_start_reservations+0x2a/0x2c [ 48.339523][ C0] x86_64_start_kernel+0x60/0x63 [ 48.344473][ C0] secondary_startup_64_no_verify+0xad/0xbb [ 48.350586][ C0] [ 48.353088][ C0] [ 48.355472][ C0] Memory state around the buggy address: [ 48.361411][ C0] ffffc90000007a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.369748][ C0] ffffc90000007a80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 [ 48.378139][ C0] >ffffc90000007b00: 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 [ 48.387518][ C0] ^ [ 48.392925][ C0] ffffc90000007b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.401089][ C0] ffffc90000007c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.409369][ C0] ================================================================== [ 48.417971][ C0] Disabling lock debugging due to kernel taint 2026/02/10 19:27:08 executed programs: 243 2026/02/10 19:27:13 executed programs: 544