.029845][ T29] audit: type=1400 audit(1777171542.715:105): avc: denied { sys_admin } for pid=3049 comm="syz-executor" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 45.196109][ T29] audit: type=1400 audit(1777171542.875:106): avc: denied { sys_chroot } for pid=3050 comm="syz-executor" capability=18 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 55.348725][ T3012] syz-executor (3012) used greatest stack depth: 23064 bytes left Warning: Permanently added '10.128.0.5' (ED25519) to the list of known hosts. 2026/04/26 02:46:26 parsed 1 programs [ 90.656453][ T29] audit: type=1400 audit(1777171588.345:107): avc: denied { unlink } for pid=3989 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 90.749326][ T3989] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 93.849578][ T29] audit: type=1401 audit(1777171591.535:108): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" 2026/04/26 02:46:41 executed programs: 0 2026/04/26 02:47:25 executed programs: 10 [ 147.645192][ T29] audit: type=1400 audit(1777171645.335:109): avc: denied { read write } for pid=6741 comm="syz.7.18" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 147.740029][ T29] audit: type=1400 audit(1777171645.335:110): avc: denied { open } for pid=6741 comm="syz.7.18" path="/dev/raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 147.784305][ T29] audit: type=1400 audit(1777171645.335:111): avc: denied { ioctl } for pid=6741 comm="syz.7.18" path="/dev/raw-gadget" dev="devtmpfs" ino=236 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 147.914596][ T9] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 148.093792][ T9] usb 8-1: Using ep0 maxpacket: 16 [ 148.117164][ T9] usb 8-1: config 246 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 148.145288][ T9] usb 8-1: config 246 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 34178, setting to 1024 [ 148.186034][ T9] usb 8-1: New USB device found, idVendor=2040, idProduct=0265, bcdDevice=4e.d1 [ 148.207015][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.231511][ T9] usb 8-1: Product: syz [ 148.248321][ T9] usb 8-1: Manufacturer: syz [ 148.263025][ T9] usb 8-1: SerialNumber: syz [ 148.328327][ T9] em28xx 8-1:246.0: New device syz syz @ 480 Mbps (2040:0265, interface 0, class 0) [ 148.349102][ T9] em28xx 8-1:246.0: Audio interface 0 found (Vendor Class) [ 148.533037][ T738] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 148.534716][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 148.573095][ T9] em28xx 8-1:246.0: unknown em28xx chip ID (0) [ 148.580090][ T9] em28xx 8-1:246.0: Config register raw data: 0xfffffffb [ 148.588101][ T9] em28xx 8-1:246.0: AC97 chip type couldn't be determined [ 148.595327][ T9] em28xx 8-1:246.0: No AC97 audio processor [ 148.601285][ T9] em28xx 8-1:246.0: We currently don't support analog TV or stream capture on dual tuners. [ 148.663104][ T9] em28xx 8-1:246.0: unknown em28xx chip ID (0) [ 148.669623][ T9] em28xx 8-1:246.0: Config register raw data: 0xfffffffb [ 148.678000][ T9] em28xx 8-1:246.0: AC97 chip type couldn't be determined [ 148.685286][ T9] em28xx 8-1:246.0: No AC97 audio processor [ 148.692964][ T738] usb 5-1: Using ep0 maxpacket: 16 [ 148.700217][ T738] usb 5-1: config 246 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 148.702797][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 148.712563][ T738] usb 5-1: config 246 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 34178, setting to 1024 [ 148.726099][ T6777] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 148.731409][ T738] usb 5-1: New USB device found, idVendor=2040, idProduct=0265, bcdDevice=4e.d1 [ 148.745911][ T738] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.746916][ T10] usb 4-1: config 246 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 148.754272][ T738] usb 5-1: Product: syz [ 148.770251][ T738] usb 5-1: Manufacturer: syz [ 148.775109][ T738] usb 5-1: SerialNumber: syz [ 148.782804][ T6786] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 148.789850][ T738] em28xx 5-1:246.0: New device syz syz @ 480 Mbps (2040:0265, interface 0, class 0) [ 148.791712][ T10] usb 4-1: config 246 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 34178, setting to 1024 [ 148.802656][ T738] em28xx 5-1:246.0: Audio interface 0 found (Vendor Class) [ 148.834983][ T10] usb 4-1: New USB device found, idVendor=2040, idProduct=0265, bcdDevice=4e.d1 [ 148.852770][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.872786][ T10] usb 4-1: Product: syz [ 148.876987][ T10] usb 4-1: Manufacturer: syz [ 148.881593][ T10] usb 4-1: SerialNumber: syz [ 148.911712][ T10] em28xx 4-1:246.0: New device syz syz @ 480 Mbps (2040:0265, interface 0, class 0) [ 148.923995][ T6777] usb 6-1: Using ep0 maxpacket: 16 [ 148.943209][ T10] em28xx 4-1:246.0: Audio interface 0 found (Vendor Class) [ 148.951716][ T6777] usb 6-1: config 246 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 148.972778][ T6777] usb 6-1: config 246 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 34178, setting to 1024 [ 148.989600][ T6786] usb 3-1: Using ep0 maxpacket: 16 [ 149.005044][ T6786] usb 3-1: config 246 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 149.022840][ T6777] usb 6-1: New USB device found, idVendor=2040, idProduct=0265, bcdDevice=4e.d1 [ 149.036650][ T6786] usb 3-1: config 246 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 34178, setting to 1024 [ 149.052784][ T6777] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.053709][ T738] em28xx 5-1:246.0: unknown em28xx chip ID (0) [ 149.074454][ T6777] usb 6-1: Product: syz [ 149.080627][ T6777] usb 6-1: Manufacturer: syz [ 149.084920][ T738] em28xx 5-1:246.0: Config register raw data: 0xfffffffb [ 149.092787][ T6777] usb 6-1: SerialNumber: syz [ 149.100521][ T738] em28xx 5-1:246.0: AC97 chip type couldn't be determined [ 149.108257][ T738] em28xx 5-1:246.0: No AC97 audio processor [ 149.109949][ T6786] usb 3-1: New USB device found, idVendor=2040, idProduct=0265, bcdDevice=4e.d1 [ 149.118876][ T738] em28xx 5-1:246.0: We currently don't support analog TV or stream capture on dual tuners. [ 149.126041][ T6786] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.148339][ T9] usb 8-1: USB disconnect, device number 2 [ 149.155708][ T6786] usb 3-1: Product: syz [ 149.163870][ T6777] em28xx 6-1:246.0: New device syz syz @ 480 Mbps (2040:0265, interface 0, class 0) [ 149.175724][ T6786] usb 3-1: Manufacturer: syz [ 149.181477][ T9] em28xx 8-1:246.0: Disconnecting em28xx #1 [ 149.187637][ T6777] em28xx 6-1:246.0: Audio interface 0 found (Vendor Class) [ 149.195066][ T10] em28xx 4-1:246.0: unknown em28xx chip ID (0) [ 149.201271][ T6786] usb 3-1: SerialNumber: syz [ 149.203153][ T738] em28xx 5-1:246.0: unknown em28xx chip ID (0) [ 149.205932][ T9] em28xx 8-1:246.0: Disconnecting em28xx [ 149.214285][ T738] em28xx 5-1:246.0: Config register raw data: 0xfffffffb [ 149.219983][ T10] em28xx 4-1:246.0: Config register raw data: 0xfffffffb [ 149.225565][ T738] em28xx 5-1:246.0: AC97 chip type couldn't be determined [ 149.234845][ T10] em28xx 4-1:246.0: AC97 chip type couldn't be determined [ 149.240350][ T738] em28xx 5-1:246.0: No AC97 audio processor [ 149.249952][ T10] em28xx 4-1:246.0: No AC97 audio processor [ 149.260534][ T9] em28xx 8-1:246.0: Freeing device [ 149.266094][ T9] em28xx 8-1:246.0: Freeing device [ 149.273966][ T6786] em28xx 3-1:246.0: New device syz syz @ 480 Mbps (2040:0265, interface 0, class 0) [ 149.286806][ T10] em28xx 4-1:246.0: We currently don't support analog TV or stream capture on dual tuners. [ 149.300334][ T6786] em28xx 3-1:246.0: Audio interface 0 found (Vendor Class) [ 149.363560][ T10] em28xx 4-1:246.0: unknown em28xx chip ID (0) [ 149.370346][ T10] em28xx 4-1:246.0: Config register raw data: 0xfffffffb [ 149.378020][ T10] em28xx 4-1:246.0: AC97 chip type couldn't be determined [ 149.393110][ T10] em28xx 4-1:246.0: No AC97 audio processor [ 149.443230][ T6777] em28xx 6-1:246.0: unknown em28xx chip ID (0) [ 149.450505][ T6777] em28xx 6-1:246.0: Config register raw data: 0xfffffffb [ 149.473601][ T6777] em28xx 6-1:246.0: AC97 chip type couldn't be determined [ 149.493003][ T6777] em28xx 6-1:246.0: No AC97 audio processor [ 149.500442][ T738] usb 5-1: USB disconnect, device number 2 [ 149.506080][ T6777] em28xx 6-1:246.0: We currently don't support analog TV or stream capture on dual tuners. [ 149.523313][ T738] em28xx 5-1:246.0: Disconnecting em28xx #4 [ 149.532967][ T6786] em28xx 3-1:246.0: unknown em28xx chip ID (0) [ 149.547131][ T6786] em28xx 3-1:246.0: Config register raw data: 0xfffffffb [ 149.549256][ T738] em28xx 5-1:246.0: Disconnecting em28xx [ 149.565606][ T6786] em28xx 3-1:246.0: AC97 chip type couldn't be determined [ 149.581331][ T738] non-slab/vmalloc memory [ 149.581355][ T6786] em28xx 3-1:246.0: No AC97 audio processor [ 149.581384][ T738] list_del corruption. prev->next should be ffff88811a24c250, but was 0000000000000000. (prev=ffff888118cec250) [ 149.603005][ T9] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 149.613148][ T6777] em28xx 6-1:246.0: unknown em28xx chip ID (0) [ 149.615191][ T738] ------------[ cut here ]------------ [ 149.625194][ T6777] em28xx 6-1:246.0: Config register raw data: 0xfffffffb [ 149.625561][ T6777] em28xx 6-1:246.0: AC97 chip type couldn't be determined [ 149.625580][ T6777] em28xx 6-1:246.0: No AC97 audio processor [ 149.646189][ T738] kernel BUG at lib/list_debug.c:62! [ 149.656056][ T738] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 149.662335][ T738] CPU: 1 UID: 0 PID: 738 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full) [ 149.671651][ T738] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 149.681713][ T738] Workqueue: usb_hub_wq hub_event [ 149.686754][ T738] RIP: 0010:__list_del_entry_valid_or_report+0x14a/0x1d0 [ 149.693775][ T738] Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 8b 55 00 48 89 e9 48 89 de 48 c7 c7 00 46 b0 87 e8 b7 bd 4d fe 90 <0f> 0b 4c 89 e7 e8 ec 18 26 ff 48 89 ea 48 b8 00 00 00 00 00 fc ff [ 149.713389][ T738] RSP: 0018:ffffc9000227f600 EFLAGS: 00010286 [ 149.719461][ T738] RAX: 000000000000006d RBX: ffff88811a24c250 RCX: 0000000000000000 [ 149.727425][ T738] RDX: 000000000000006d RSI: ffffffff8191c2d9 RDI: fffff5200044feb1 [ 149.735389][ T738] RBP: ffff888118cec250 R08: 0000000000000005 R09: 0000000000000000 [ 149.743440][ T738] R10: 0000000080000000 R11: 0000000000000000 R12: ffff8881259a8250 [ 149.751405][ T738] R13: ffff88811a24c000 R14: ffffffff8a77e2c8 R15: ffffed1023449c6f [ 149.759367][ T738] FS: 0000000000000000(0000) GS:ffff8882687a9000(0000) knlGS:0000000000000000 [ 149.768289][ T738] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 149.774868][ T738] CR2: 00007fb8e02f0130 CR3: 00000000094ac000 CR4: 00000000003506f0 [ 149.782838][ T738] Call Trace: [ 149.786201][ T738] [ 149.789151][ T738] em28xx_close_extension+0x10b/0x2b0 [ 149.794537][ T738] em28xx_usb_disconnect.cold+0x13d/0x253 [ 149.800260][ T738] usb_unbind_interface+0x1dd/0x9e0 [ 149.805467][ T738] ? __pfx_usb_unbind_interface+0x10/0x10 [ 149.811190][ T738] device_remove+0x12a/0x180 [ 149.815791][ T738] device_release_driver_internal+0x44e/0x620 [ 149.821867][ T738] bus_remove_device+0x2bc/0x560 [ 149.826813][ T738] ? __pfx_bus_remove_device+0x10/0x10 [ 149.832272][ T738] ? __pfx_device_remove_attrs+0x10/0x10 [ 149.837907][ T738] device_del+0x376/0x9b0 [ 149.842245][ T738] ? __pfx_device_del+0x10/0x10 [ 149.847187][ T738] ? kobject_put+0xb9/0x640 [ 149.851709][ T738] usb_disable_device+0x367/0x810 [ 149.856739][ T738] usb_disconnect+0x2e2/0x9a0 [ 149.861418][ T738] hub_event+0x1d0c/0x4af0 [ 149.865842][ T738] ? __lock_acquire+0x4a5/0x2630 [ 149.870786][ T738] ? do_raw_spin_unlock+0x145/0x1e0 [ 149.875983][ T738] ? __pfx_hub_event+0x10/0x10 [ 149.880757][ T738] ? assoc_array_insert+0x22e0/0x32c0 [ 149.886130][ T738] ? rcu_is_watching+0x12/0xc0 [ 149.890891][ T738] process_one_work+0xa0e/0x1980 [ 149.895834][ T738] ? __pfx_process_one_work+0x10/0x10 [ 149.901221][ T738] ? __pfx_hub_event+0x10/0x10 [ 149.905987][ T738] worker_thread+0x5ef/0xe50 [ 149.910582][ T738] ? __pfx_worker_thread+0x10/0x10 [ 149.915699][ T738] ? kthread+0x13a/0x450 [ 149.919935][ T738] ? __pfx_worker_thread+0x10/0x10 [ 149.925040][ T738] kthread+0x370/0x450 [ 149.929102][ T738] ? __pfx_kthread+0x10/0x10 [ 149.933692][ T738] ret_from_fork+0x69a/0xc80 [ 149.938283][ T738] ? __pfx_ret_from_fork+0x10/0x10 [ 149.943394][ T738] ? __switch_to+0x7f6/0x1100 [ 149.948077][ T738] ? __switch_to_asm+0x39/0x70 [ 149.952842][ T738] ? __pfx_kthread+0x10/0x10 [ 149.957429][ T738] ret_from_fork_asm+0x1a/0x30 [ 149.962290][ T738] [ 149.965312][ T738] Modules linked in: [ 149.969583][ T738] ---[ end trace 0000000000000000 ]--- [ 149.987886][ T738] RIP: 0010:__list_del_entry_valid_or_report+0x14a/0x1d0 [ 149.997900][ T738] Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 8d 00 00 00 48 8b 55 00 48 89 e9 48 89 de 48 c7 c7 00 46 b0 87 e8 b7 bd 4d fe 90 <0f> 0b 4c 89 e7 e8 ec 18 26 ff 48 89 ea 48 b8 00 00 00 00 00 fc ff [ 150.019377][ T10] usb 4-1: USB disconnect, device number 2 [ 150.026290][ T10] em28xx 4-1:246.0: Disconnecting em28xx #1 [ 150.033143][ T10] em28xx 4-1:246.0: Disconnecting em28xx [ 150.039558][ T738] RSP: 0018:ffffc9000227f600 EFLAGS: 00010286 [ 150.045909][ T738] RAX: 000000000000006d RBX: ffff88811a24c250 RCX: 0000000000000000 [ 150.053906][ T738] RDX: 000000000000006d RSI: ffffffff8191c2d9 RDI: fffff5200044feb1 [ 150.061884][ T738] RBP: ffff888118cec250 R08: 0000000000000005 R09: 0000000000000000 [ 150.069987][ T738] R10: 0000000080000000 R11: 0000000000000000 R12: ffff8881259a8250 [ 150.078364][ T738] R13: ffff88811a24c000 R14: ffffffff8a77e2c8 R15: ffffed1023449c6f [ 150.086465][ T738] FS: 0000000000000000(0000) GS:ffff8882687a9000(0000) knlGS:0000000000000000 [ 150.092776][ T9] usb 8-1: Using ep0 maxpacket: 16 [ 150.095431][ T738] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 150.101899][ T9] usb 8-1: config 246 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 150.107280][ T738] CR2: 00007ffce166ec54 CR3: 0000000114ae8000 CR4: 00000000003506f0 [ 150.118919][ T9] usb 8-1: config 246 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 34178, setting to 1024 [ 150.127079][ T738] Kernel panic - not syncing: Fatal exception [ 150.138370][ T738] Kernel Offset: disabled