[ 47.119713][ T47] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.127199][ T47] device bridge_slave_0 left promiscuous mode [ 47.133313][ T47] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.140717][ T47] device veth1_macvtap left promiscuous mode [ 47.146751][ T47] device veth0_vlan left promiscuous mode [ 55.226480][ T23] kauditd_printk_skb: 30 callbacks suppressed [ 55.226485][ T23] audit: type=1400 audit(1769411246.420:104): avc: denied { transition } for pid=365 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 55.255106][ T23] audit: type=1400 audit(1769411246.420:105): avc: denied { noatsecure } for pid=365 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 55.274889][ T23] audit: type=1400 audit(1769411246.420:106): avc: denied { rlimitinh } for pid=365 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 55.293718][ T23] audit: type=1400 audit(1769411246.420:107): avc: denied { siginh } for pid=365 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.217' (ED25519) to the list of known hosts. 2026/01/26 07:07:34 parsed 1 programs [ 63.231858][ T23] audit: type=1400 audit(1769411254.420:108): avc: denied { unlink } for pid=385 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 63.287461][ T385] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 63.725258][ T403] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.732284][ T403] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.739748][ T403] device bridge_slave_0 entered promiscuous mode [ 63.746384][ T403] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.753493][ T403] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.760662][ T403] device bridge_slave_1 entered promiscuous mode [ 63.783882][ T403] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.790936][ T403] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.798194][ T403] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.805291][ T403] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.820535][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 63.827724][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.835030][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 63.842402][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 63.850814][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 63.858964][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.865991][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.875154][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 63.883360][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.890358][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.900130][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 63.908771][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 63.920671][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 63.930454][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 63.938788][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 63.946257][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 63.954823][ T403] device veth0_vlan entered promiscuous mode [ 63.962787][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 63.971351][ T403] device veth1_macvtap entered promiscuous mode [ 63.979487][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 63.989382][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 64.135657][ T23] audit: type=1401 audit(1769411255.330:109): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" 2026/01/26 07:07:35 executed programs: 0 [ 64.365581][ T434] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.372621][ T434] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.380268][ T434] device bridge_slave_0 entered promiscuous mode [ 64.387139][ T434] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.394210][ T434] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.401415][ T434] device bridge_slave_1 entered promiscuous mode [ 64.429142][ T434] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.436192][ T434] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.443472][ T434] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.450504][ T434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.464033][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 64.471436][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.478626][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.490316][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 64.498524][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.505632][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.514145][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 64.522246][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.529375][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.540146][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 64.548833][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 64.560023][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 64.572315][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 64.580244][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.587641][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 64.598972][ T434] device veth0_vlan entered promiscuous mode [ 64.607530][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 64.616299][ T434] device veth1_macvtap entered promiscuous mode [ 64.628104][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 64.637148][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 64.793580][ T439] device veth0_vlan left promiscuous mode [ 64.799657][ T439] device veth0_vlan entered promiscuous mode [ 64.844025][ T47] device bridge_slave_1 left promiscuous mode [ 64.850151][ T47] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.857808][ T47] device bridge_slave_0 left promiscuous mode [ 64.864066][ T47] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.871789][ T47] device veth1_macvtap left promiscuous mode [ 64.877944][ T47] device veth0_vlan left promiscuous mode [ 65.954276][ T47] ================================================================== [ 65.962365][ T47] BUG: KASAN: use-after-free in vlan_dev_get_iflink+0x62/0x70 [ 65.969797][ T47] Read of size 4 at addr ffff88812848e100 by task kworker/u4:2/47 [ 65.977568][ T47] [ 65.979877][ T47] CPU: 1 PID: 47 Comm: kworker/u4:2 Not tainted syzkaller #0 [ 65.987225][ T47] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 65.997352][ T47] Workqueue: netns cleanup_net [ 66.002094][ T47] Call Trace: [ 66.005364][ T47] dump_stack_lvl+0x81/0xac [ 66.009839][ T47] print_address_description.constprop.0+0x24/0x160 [ 66.016397][ T47] ? vlan_dev_get_iflink+0x62/0x70 [ 66.021493][ T47] kasan_report.cold+0x82/0xdb [ 66.026230][ T47] ? vlan_dev_get_iflink+0x62/0x70 [ 66.031312][ T47] __asan_report_load4_noabort+0x14/0x20 [ 66.037002][ T47] vlan_dev_get_iflink+0x62/0x70 [ 66.041910][ T47] dev_get_iflink+0x64/0xc0 [ 66.046382][ T47] rfc2863_policy+0x1bb/0x230 [ 66.051026][ T47] linkwatch_do_dev+0x28/0xf0 [ 66.055674][ T47] linkwatch_forget_dev+0x157/0x200 [ 66.060843][ T47] netdev_run_todo+0x234/0xb10 [ 66.065575][ T47] ? unregister_netdevice_many+0xc77/0x14c0 [ 66.071441][ T47] ? generic_xdp_install+0x5a0/0x5a0 [ 66.076715][ T47] rtnl_unlock+0x9/0x10 [ 66.080857][ T47] default_device_exit_batch+0x3d8/0x510 [ 66.086468][ T47] ? unregister_netdevice_many+0x14c0/0x14c0 [ 66.092437][ T47] ? default_device_exit+0x20d/0x2c0 [ 66.097703][ T47] ? preempt_schedule_irq+0x90/0x90 [ 66.102875][ T47] ops_exit_list+0xd9/0x130 [ 66.107360][ T47] ? netns_bpf_pernet_pre_exit+0x11a/0x170 [ 66.113148][ T47] cleanup_net+0x403/0x960 [ 66.117574][ T47] ? peernet2id+0x50/0x50 [ 66.122057][ T47] ? __kasan_check_read+0x11/0x20 [ 66.127070][ T47] ? strscpy+0x94/0x280 [ 66.131204][ T47] ? pwq_dec_nr_in_flight+0x165/0x350 [ 66.136573][ T47] process_one_work+0x5f5/0xe40 [ 66.141396][ T47] worker_thread+0x402/0xcd0 [ 66.146003][ T47] ? rescuer_thread+0xc30/0xc30 [ 66.150826][ T47] kthread+0x345/0x420 [ 66.154893][ T47] ? schedule_tail+0xe9/0x1e0 [ 66.159577][ T47] ? kthread_create_worker_on_cpu+0xd0/0xd0 [ 66.165477][ T47] ret_from_fork+0x1f/0x30 [ 66.169891][ T47] [ 66.172231][ T47] Allocated by task 434: [ 66.176473][ T47] kasan_save_stack+0x26/0x50 [ 66.181232][ T47] __kasan_kmalloc+0xae/0xe0 [ 66.185829][ T47] __kmalloc+0x1cd/0x360 [ 66.190078][ T47] kvmalloc_node+0x25/0x90 [ 66.194493][ T47] alloc_netdev_mqs+0x5d/0xdc0 [ 66.199254][ T47] rtnl_create_link+0x1e2/0xb80 [ 66.204088][ T47] __rtnl_newlink+0xcdd/0x14e0 [ 66.208834][ T47] rtnl_newlink+0x5f/0x90 [ 66.213152][ T47] rtnetlink_rcv_msg+0x334/0x970 [ 66.218085][ T47] netlink_rcv_skb+0x133/0x3c0 [ 66.222843][ T47] rtnetlink_rcv+0x10/0x20 [ 66.227260][ T47] netlink_unicast+0x642/0xad0 [ 66.232008][ T47] netlink_sendmsg+0x815/0xd10 [ 66.236761][ T47] __sock_sendmsg+0xb5/0xf0 [ 66.241257][ T47] __sys_sendto+0x1e3/0x2f0 [ 66.245754][ T47] __x64_sys_sendto+0xdc/0x1a0 [ 66.250514][ T47] do_syscall_64+0x32/0x50 [ 66.254927][ T47] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 66.260888][ T47] [ 66.263220][ T47] Freed by task 47: [ 66.267025][ T47] kasan_save_stack+0x26/0x50 [ 66.271702][ T47] kasan_set_track+0x25/0x30 [ 66.276292][ T47] kasan_set_free_info+0x24/0x40 [ 66.281232][ T47] __kasan_slab_free+0x111/0x150 [ 66.286157][ T47] slab_free_freelist_hook+0x9b/0x1a0 [ 66.291601][ T47] kfree+0xc2/0x4e0 [ 66.295399][ T47] kvfree+0x25/0x30 [ 66.299230][ T47] netdev_freemem+0x47/0x60 [ 66.303732][ T47] netdev_release+0x68/0x80 [ 66.308246][ T47] device_release+0x9d/0x1a0 [ 66.312832][ T47] kobject_cleanup+0xb5/0x180 [ 66.317501][ T47] kobject_put+0x45/0x60 [ 66.321745][ T47] netdev_run_todo+0x6a6/0xb10 [ 66.326505][ T47] rtnl_unlock+0x9/0x10 [ 66.330657][ T47] default_device_exit_batch+0x3d8/0x510 [ 66.336279][ T47] ops_exit_list+0xd9/0x130 [ 66.340764][ T47] cleanup_net+0x403/0x960 [ 66.345171][ T47] process_one_work+0x5f5/0xe40 [ 66.350102][ T47] worker_thread+0x402/0xcd0 [ 66.354690][ T47] kthread+0x345/0x420 [ 66.358752][ T47] ret_from_fork+0x1f/0x30 [ 66.363172][ T47] [ 66.365501][ T47] The buggy address belongs to the object at ffff88812848e000 [ 66.365501][ T47] which belongs to the cache kmalloc-4k of size 4096 [ 66.379556][ T47] The buggy address is located 256 bytes inside of [ 66.379556][ T47] 4096-byte region [ffff88812848e000, ffff88812848f000) [ 66.392908][ T47] The buggy address belongs to the page: [ 66.398632][ T47] page:ffffea0004a12200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x128488 [ 66.408946][ T47] head:ffffea0004a12200 order:3 compound_mapcount:0 compound_pincount:0 [ 66.417265][ T47] flags: 0x4000000000010200(slab|head) [ 66.422722][ T47] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042c00 [ 66.431301][ T47] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 66.440075][ T47] page dumped because: kasan: bad access detected [ 66.446482][ T47] page_owner tracks the page as allocated [ 66.452194][ T47] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 434, ts 64422441859, free_ts 0 [ 66.471787][ T47] get_page_from_freelist+0x1fee/0x2ad0 [ 66.477417][ T47] __alloc_pages_nodemask+0x2ae/0x2530 [ 66.482959][ T47] allocate_slab+0x30f/0x460 [ 66.487573][ T47] ___slab_alloc.constprop.0+0x32b/0x730 [ 66.493268][ T47] __kmalloc_track_caller+0x325/0x360 [ 66.498615][ T47] kmemdup+0x1c/0x40 [ 66.502493][ T47] __addrconf_sysctl_register+0x97/0x440 [ 66.508108][ T47] addrconf_sysctl_register+0xfd/0x190 [ 66.513543][ T47] ipv6_add_dev.part.0+0x80c/0xf90 [ 66.518651][ T47] addrconf_notify+0x60a/0x1c50 [ 66.523487][ T47] raw_notifier_call_chain+0x8e/0xd0 [ 66.528746][ T47] register_netdevice+0xc10/0x14a0 [ 66.533835][ T47] veth_newlink+0x448/0x950 [ 66.538316][ T47] __rtnl_newlink+0xdb8/0x14e0 [ 66.543056][ T47] rtnl_newlink+0x5f/0x90 [ 66.547360][ T47] rtnetlink_rcv_msg+0x334/0x970 [ 66.552275][ T47] page_owner free stack trace missing [ 66.557620][ T47] [ 66.559928][ T47] Memory state around the buggy address: [ 66.565625][ T47] ffff88812848e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.573678][ T47] ffff88812848e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.581713][ T47] >ffff88812848e100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.589747][ T47] ^ [ 66.593793][ T47] ffff88812848e180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.601829][ T47] ffff88812848e200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.609865][ T47] ================================================================== [ 66.618203][ T47] Disabling lock debugging due to kernel taint [ 66.630672][ T23] audit: type=1400 audit(1769411257.820:110): avc: denied { read } for pid=73 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 66.668854][ T23] audit: type=1400 audit(1769411257.820:111): avc: denied { search } for pid=73 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 66.695767][ T23] audit: type=1400 audit(1769411257.820:112): avc: denied { write } for pid=73 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 66.719048][ T23] audit: type=1400 audit(1769411257.820:113): avc: denied { add_name } for pid=73 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 66.741592][ T23] audit: type=1400 audit(1769411257.820:114): avc: denied { create } for pid=73 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 66.762413][ T23] audit: type=1400 audit(1769411257.820:115): avc: denied { append open } for pid=73 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 66.787817][ T23] audit: type=1400 audit(1769411257.820:116): avc: denied { getattr } for pid=73 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 2026/01/26 07:07:40 executed programs: 228 2026/01/26 07:07:45 executed programs: 516