[ 27.432179][ T9] device bridge_slave_0 left promiscuous mode [ 27.438514][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.446892][ T9] device bridge_slave_1 left promiscuous mode [ 27.453056][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.460891][ T9] device bridge_slave_0 left promiscuous mode [ 27.467382][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.475698][ T9] device veth1_macvtap left promiscuous mode [ 27.482031][ T9] device veth0_vlan left promiscuous mode [ 27.488052][ T9] device veth1_macvtap left promiscuous mode [ 27.494082][ T9] device veth0_vlan left promiscuous mode Warning: Permanently added '10.128.1.145' (ED25519) to the list of known hosts. 2026/09/08 20:24:44 parsed 1 programs 2026/09/08 20:24:44 serving rpc on tcp://42305 [ 36.391159][ T24] kauditd_printk_skb: 31 callbacks suppressed [ 36.391171][ T24] audit: type=1400 audit(1788899085.360:105): avc: denied { unlink } for pid=438 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 36.500301][ T24] audit: type=1400 audit(1788899085.470:106): avc: denied { write } for pid=441 comm="mkswap" path="pipe:[15642]" dev="pipefs" ino=15642 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 36.523386][ T438] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 36.967964][ T24] audit: type=1401 audit(1788899085.940:107): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 37.079953][ T450] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.100875][ T24] audit: type=1400 audit(1788899086.070:108): avc: denied { create } for pid=466 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.102629][ T450] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.130731][ T450] device bridge_slave_0 entered promiscuous mode [ 37.180031][ T450] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.188850][ T450] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.196542][ T450] device bridge_slave_1 entered promiscuous mode [ 37.391297][ T450] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.398503][ T450] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.405821][ T450] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.412933][ T450] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.462555][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.471669][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.482247][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 37.492780][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.520447][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.534454][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.561218][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.587846][ T450] device veth0_vlan entered promiscuous mode [ 37.604713][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 37.640901][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 37.666865][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 37.679456][ T450] device veth1_macvtap entered promiscuous mode [ 37.687364][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 37.706935][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 37.727715][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/09/08 20:24:46 executed programs: 0 [ 37.893635][ T505] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.900845][ T505] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.908359][ T505] device bridge_slave_0 entered promiscuous mode [ 37.915428][ T505] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.922668][ T505] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.930214][ T505] device bridge_slave_1 entered promiscuous mode [ 38.034204][ T514] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.041610][ T514] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.049113][ T514] device bridge_slave_0 entered promiscuous mode [ 38.056556][ T511] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.063671][ T511] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.071049][ T511] device bridge_slave_0 entered promiscuous mode [ 38.077955][ T511] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.085259][ T511] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.093874][ T511] device bridge_slave_1 entered promiscuous mode [ 38.109755][ T514] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.116910][ T514] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.124342][ T514] device bridge_slave_1 entered promiscuous mode [ 38.167434][ T515] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.174575][ T515] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.182060][ T515] device bridge_slave_0 entered promiscuous mode [ 38.191413][ T515] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.198674][ T515] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.206065][ T515] device bridge_slave_1 entered promiscuous mode [ 38.267236][ T508] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.274496][ T508] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.282055][ T508] device bridge_slave_0 entered promiscuous mode [ 38.311894][ T508] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.319435][ T508] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.326918][ T508] device bridge_slave_1 entered promiscuous mode [ 38.409312][ T515] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.416472][ T515] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.423866][ T515] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.431191][ T515] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.479703][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.487149][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.495031][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.502954][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.528784][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 38.537451][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.545805][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.552839][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.560281][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 38.569104][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.577709][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.585128][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.592588][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.600045][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.607815][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 38.637886][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 38.645888][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.654462][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 38.662564][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.670785][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 38.679491][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.687725][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.695154][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.702634][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 38.711005][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.719412][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.726465][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.733945][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.741538][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.749251][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.757415][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.765904][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.773069][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.780578][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.788753][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.797592][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.804904][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.831031][ T511] device veth0_vlan entered promiscuous mode [ 38.838250][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.846662][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.855256][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.862972][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 38.870637][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 38.878319][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.885838][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.893536][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 38.902076][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.910741][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.917810][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.925319][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 38.933867][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.942441][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.949656][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.957287][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.965289][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.973705][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 38.996967][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.004791][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.013253][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.022030][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.029102][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.037126][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.045102][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.053513][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 39.071441][ T511] device veth1_macvtap entered promiscuous mode [ 39.089622][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 39.099277][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.107951][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.115067][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.129382][ T505] device veth0_vlan entered promiscuous mode [ 39.148151][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.156720][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.165767][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 39.174208][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.182455][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 39.190788][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.199098][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.207091][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.214997][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.223441][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.231851][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.240246][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.248567][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.257088][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.265292][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.273672][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.282069][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.289743][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.306268][ T508] device veth0_vlan entered promiscuous mode [ 39.315971][ T514] device veth0_vlan entered promiscuous mode [ 39.322852][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.331442][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.341232][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.349136][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.357223][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.365170][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.373623][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.381340][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.388818][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.396368][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.406992][ T515] device veth0_vlan entered promiscuous mode [ 39.431449][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.439816][ T24] audit: type=1400 audit(1788899088.400:109): avc: denied { mount } for pid=529 comm="syz.2.19" name="/" dev="configfs" ino=1155 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 39.442421][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.464197][ T24] audit: type=1400 audit(1788899088.400:110): avc: denied { search } for pid=529 comm="syz.2.19" name="/" dev="configfs" ino=1155 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 39.474067][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.500002][ T24] audit: type=1400 audit(1788899088.400:111): avc: denied { write } for pid=529 comm="syz.2.19" name="usb_gadget" dev="configfs" ino=1156 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 39.504046][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.525223][ T24] audit: type=1400 audit(1788899088.400:112): avc: denied { add_name } for pid=529 comm="syz.2.19" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 39.533988][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.560963][ T24] audit: type=1400 audit(1788899088.400:113): avc: denied { create } for pid=529 comm="syz.2.19" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 39.561609][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.580685][ T24] audit: type=1400 audit(1788899088.410:114): avc: denied { create } for pid=529 comm="syz.2.19" name="uac2.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 39.617229][ T508] device veth1_macvtap entered promiscuous mode [ 39.624974][ T514] device veth1_macvtap entered promiscuous mode [ 39.634948][ T515] device veth1_macvtap entered promiscuous mode [ 39.642353][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.650657][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.659432][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.667848][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.675524][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.684314][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.693807][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.704696][ T505] device veth1_macvtap entered promiscuous mode [ 39.718729][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.727317][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.735540][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.785061][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.793911][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.803401][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.812741][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.821807][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.830860][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.841590][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.850724][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.859819][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.868573][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.877120][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.885599][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.894585][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.905350][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.914128][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.923341][ T500] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 40.857651][ T49] device bridge_slave_1 left promiscuous mode [ 40.874083][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.895390][ T49] device bridge_slave_0 left promiscuous mode [ 40.906879][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.931238][ T49] device veth1_macvtap left promiscuous mode [ 40.964026][ T49] device veth0_vlan left promiscuous mode 2026/09/08 20:24:51 executed programs: 669 [ 43.829409][ T2369] ================================================================== [ 43.837674][ T2369] BUG: KASAN: use-after-free in config_item_get+0x27/0x90 [ 43.844866][ T2369] Write of size 4 at addr ffff88811dbcd41c by task syz.3.923/2369 [ 43.852992][ T2369] [ 43.855409][ T2369] CPU: 1 PID: 2369 Comm: syz.3.923 Not tainted syzkaller #0 [ 43.862775][ T2369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 43.872894][ T2369] Call Trace: [ 43.876231][ T2369] __dump_stack+0x21/0x24 [ 43.880558][ T2369] dump_stack_lvl+0x1a7/0x208 [ 43.885476][ T2369] ? show_regs_print_info+0x18/0x18 [ 43.890689][ T2369] ? thaw_kernel_threads+0x220/0x220 [ 43.895990][ T2369] print_address_description+0x7f/0x2c0 [ 43.901716][ T2369] ? config_item_get+0x27/0x90 [ 43.906582][ T2369] kasan_report+0x100/0x140 [ 43.911176][ T2369] ? config_item_get+0x27/0x90 [ 43.915922][ T2369] kasan_check_range+0x249/0x2a0 [ 43.920849][ T2369] __kasan_check_write+0x14/0x20 [ 43.925771][ T2369] config_item_get+0x27/0x90 [ 43.930627][ T2369] configfs_symlink+0x44f/0x1320 [ 43.935681][ T2369] ? show_sid+0x1b0/0x1b0 [ 43.939996][ T2369] ? __lookup_hash+0x122/0x250 [ 43.944985][ T2369] ? detach_groups+0x370/0x370 [ 43.949986][ T2369] ? selinux_inode_symlink+0x22/0x30 [ 43.955265][ T2369] ? security_inode_symlink+0xba/0x100 [ 43.960904][ T2369] vfs_symlink+0x339/0x4c0 [ 43.965309][ T2369] do_symlinkat+0x10e/0x3d0 [ 43.969799][ T2369] __x64_sys_symlinkat+0x7b/0x90 [ 43.974751][ T2369] do_syscall_64+0x31/0x40 [ 43.979562][ T2369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.985641][ T2369] RIP: 0033:0x7fe204bbee99 [ 43.990047][ T2369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 44.009989][ T2369] RSP: 002b:00007fe204a20028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 44.018388][ T2369] RAX: ffffffffffffffda RBX: 00007fe204e46fa0 RCX: 00007fe204bbee99 [ 44.026434][ T2369] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300 [ 44.034479][ T2369] RBP: 00007fe204c54eaf R08: 0000000000000000 R09: 0000000000000000 [ 44.042432][ T2369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 44.050387][ T2369] R13: 00007fe204e47038 R14: 00007fe204e46fa0 R15: 00007ffca951a328 [ 44.058347][ T2369] [ 44.060829][ T2369] Allocated by task 2368: [ 44.065165][ T2369] __kasan_kmalloc+0xd4/0x100 [ 44.069895][ T2369] kmem_cache_alloc_trace+0x179/0x2e0 [ 44.075439][ T2369] afunc_alloc_inst+0x4c/0x310 [ 44.080213][ T2369] usb_get_function_instance+0xe2/0x2f0 [ 44.085756][ T2369] function_make+0x118/0x350 [ 44.090629][ T2369] configfs_mkdir+0x5d2/0xd90 [ 44.095583][ T2369] vfs_mkdir+0x42c/0x600 [ 44.099831][ T2369] do_mkdirat+0x14c/0x340 [ 44.104232][ T2369] __x64_sys_mkdirat+0x7b/0x90 [ 44.108975][ T2369] do_syscall_64+0x31/0x40 [ 44.113467][ T2369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 44.119611][ T2369] [ 44.122016][ T2369] Freed by task 2368: [ 44.126151][ T2369] kasan_set_track+0x4a/0x70 [ 44.131198][ T2369] kasan_set_free_info+0x23/0x40 [ 44.137168][ T2369] ____kasan_slab_free+0x125/0x160 [ 44.142494][ T2369] __kasan_slab_free+0x11/0x20 [ 44.147977][ T2369] slab_free_freelist_hook+0xc5/0x190 [ 44.153744][ T2369] kfree+0xc0/0x270 [ 44.157718][ T2369] afunc_free_inst+0x15/0x20 [ 44.162306][ T2369] usb_put_function_instance+0x85/0xa0 [ 44.167773][ T2369] f_uac2_attr_release+0x15/0x20 [ 44.172955][ T2369] config_item_put+0x158/0x210 [ 44.178007][ T2369] configfs_rmdir+0x89f/0x960 [ 44.182740][ T2369] vfs_rmdir+0x1ab/0x3c0 [ 44.187825][ T2369] do_rmdir+0x232/0x630 [ 44.192715][ T2369] __x64_sys_unlinkat+0xc7/0xf0 [ 44.198420][ T2369] do_syscall_64+0x31/0x40 [ 44.203453][ T2369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 44.209521][ T2369] [ 44.211847][ T2369] The buggy address belongs to the object at ffff88811dbcd400 [ 44.211847][ T2369] which belongs to the cache kmalloc-512 of size 512 [ 44.226148][ T2369] The buggy address is located 28 bytes inside of [ 44.226148][ T2369] 512-byte region [ffff88811dbcd400, ffff88811dbcd600) [ 44.239450][ T2369] The buggy address belongs to the page: [ 44.245071][ T2369] page:ffffea000476f300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11dbcc [ 44.255474][ T2369] head:ffffea000476f300 order:2 compound_mapcount:0 compound_pincount:0 [ 44.263792][ T2369] flags: 0x4000000000010200(slab|head) [ 44.269244][ T2369] raw: 4000000000010200 ffffea0004ba3300 0000000200000002 ffff888100043080 [ 44.277817][ T2369] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 44.286497][ T2369] page dumped because: kasan: bad access detected [ 44.292917][ T2369] page_owner tracks the page as allocated [ 44.298629][ T2369] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 230, ts 16188952263, free_ts 15927266269 [ 44.318011][ T2369] prep_new_page+0x176/0x190 [ 44.322775][ T2369] get_page_from_freelist+0x225f/0x23f0 [ 44.328432][ T2369] __alloc_pages_nodemask+0x29a/0x640 [ 44.333985][ T2369] new_slab+0x84/0x3f0 [ 44.338222][ T2369] ___slab_alloc+0x2f8/0x4c0 [ 44.342805][ T2369] __slab_alloc+0x63/0xa0 [ 44.347244][ T2369] __kmalloc_track_caller+0x1e4/0x310 [ 44.352709][ T2369] __alloc_skb+0xdc/0x520 [ 44.357174][ T2369] alloc_skb_with_frags+0xa3/0x560 [ 44.362370][ T2369] sock_alloc_send_pskb+0x87f/0x9a0 [ 44.367552][ T2369] unix_stream_sendmsg+0x4c9/0xbe0 [ 44.372751][ T2369] sock_write_iter+0x2a6/0x3a0 [ 44.378329][ T2369] vfs_write+0x770/0xd70 [ 44.382910][ T2369] ksys_write+0x14a/0x260 [ 44.387330][ T2369] __x64_sys_write+0x7b/0x90 [ 44.391919][ T2369] do_syscall_64+0x31/0x40 [ 44.396317][ T2369] page last free stack trace: [ 44.401168][ T2369] free_unref_page_prepare+0x2b7/0x2d0 [ 44.406621][ T2369] free_unref_page+0x7f/0x190 [ 44.411284][ T2369] __put_page+0xae/0xe0 [ 44.415674][ T2369] anon_pipe_buf_release+0x165/0x1f0 [ 44.420967][ T2369] pipe_read+0x563/0x1050 [ 44.425284][ T2369] vfs_read+0x62a/0xa50 [ 44.429422][ T2369] ksys_read+0x14a/0x260 [ 44.433652][ T2369] __x64_sys_read+0x7b/0x90 [ 44.438319][ T2369] do_syscall_64+0x31/0x40 [ 44.442727][ T2369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 44.448605][ T2369] [ 44.451016][ T2369] Memory state around the buggy address: [ 44.456645][ T2369] ffff88811dbcd300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.464876][ T2369] ffff88811dbcd380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.473019][ T2369] >ffff88811dbcd400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.481088][ T2369] ^ [ 44.485943][ T2369] ffff88811dbcd480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.494081][ T2369] ffff88811dbcd500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.502209][ T2369] ================================================================== [ 44.510248][ T2369] Disabling lock debugging due to kernel taint [ 44.517365][ T2369] ------------[ cut here ]------------ [ 44.523013][ T2369] refcount_t: addition on 0; use-after-free. [ 44.529560][ T2369] WARNING: CPU: 1 PID: 2369 at lib/refcount.c:25 refcount_warn_saturate+0x104/0x1a0 [ 44.538927][ T2369] Modules linked in: [ 44.542936][ T2369] CPU: 1 PID: 2369 Comm: syz.3.923 Tainted: G B syzkaller #0 [ 44.551630][ T2369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 44.561861][ T2369] RIP: 0010:refcount_warn_saturate+0x104/0x1a0 [ 44.568100][ T2369] Code: 04 01 48 c7 c7 80 52 40 85 e8 d8 60 3b 02 0f 0b eb df e8 bf 8e 26 ff c6 05 6d 73 82 04 01 48 c7 c7 c0 51 40 85 e8 bc 60 3b 02 <0f> 0b eb c3 e8 a3 8e 26 ff c6 05 52 73 82 04 01 48 c7 c7 20 52 40 [ 44.587883][ T2369] RSP: 0018:ffffc90001bbfc98 EFLAGS: 00010246 [ 44.593932][ T2369] RAX: e9fa1fbf2da09500 RBX: 0000000000000002 RCX: ffff88811fcdd000 [ 44.601899][ T2369] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 44.609940][ T2369] RBP: ffffc90001bbfca8 R08: ffffc90001bbf627 R09: fffff52000377ef8 [ 44.617939][ T2369] R10: dffffc0000000000 R11: fffff52000377ec5 R12: ffff888106fac210 [ 44.626095][ T2369] R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000 [ 44.634256][ T2369] FS: 00007fe204a206c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 44.643529][ T2369] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.650611][ T2369] CR2: 00007fe204a90c60 CR3: 000000010f55d000 CR4: 00000000003506a0 [ 44.658784][ T2369] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 44.667070][ T2369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 44.675228][ T2369] Call Trace: [ 44.678547][ T2369] config_item_get+0x8c/0x90 [ 44.683167][ T2369] configfs_symlink+0x44f/0x1320 [ 44.688332][ T2369] ? show_sid+0x1b0/0x1b0 [ 44.692844][ T2369] ? __lookup_hash+0x122/0x250 [ 44.697712][ T2369] ? detach_groups+0x370/0x370 [ 44.702484][ T2369] ? selinux_inode_symlink+0x22/0x30 [ 44.707937][ T2369] ? security_inode_symlink+0xba/0x100 [ 44.713482][ T2369] vfs_symlink+0x339/0x4c0 [ 44.718296][ T2369] do_symlinkat+0x10e/0x3d0 [ 44.722985][ T2369] __x64_sys_symlinkat+0x7b/0x90 [ 44.728655][ T2369] do_syscall_64+0x31/0x40 [ 44.733121][ T2369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 44.739013][ T2369] RIP: 0033:0x7fe204bbee99 [ 44.743432][ T2369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 44.763052][ T2369] RSP: 002b:00007fe204a20028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 44.771499][ T2369] RAX: ffffffffffffffda RBX: 00007fe204e46fa0 RCX: 00007fe204bbee99 [ 44.779468][ T2369] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300 [ 44.787613][ T2369] RBP: 00007fe204c54eaf R08: 0000000000000000 R09: 0000000000000000 [ 44.795681][ T2369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 44.803884][ T2369] R13: 00007fe204e47038 R14: 00007fe204e46fa0 R15: 00007ffca951a328 [ 44.812003][ T2369] ---[ end trace 163e1479ef196854 ]--- [ 44.825984][ T24] kauditd_printk_skb: 4 callbacks suppressed [ 44.825995][ T24] audit: type=1400 audit(1788899093.790:119): avc: denied { read } for pid=77 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 44.868610][ T24] audit: type=1400 audit(1788899093.790:120): avc: denied { search } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 44.900928][ T24] audit: type=1400 audit(1788899093.790:121): avc: denied { write } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 44.932309][ T24] audit: type=1400 audit(1788899093.790:122): avc: denied { add_name } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 44.959042][ T24] audit: type=1400 audit(1788899093.790:123): avc: denied { create } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 44.986455][ T24] audit: type=1400 audit(1788899093.790:124): avc: denied { append open } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 45.026240][ T24] audit: type=1400 audit(1788899093.790:125): avc: denied { getattr } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 45.066329][ T2369] ------------[ cut here ]------------ [ 45.074372][ T2369] refcount_t: underflow; use-after-free. [ 45.089603][ T2369] WARNING: CPU: 0 PID: 2369 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 45.100985][ T2369] Modules linked in: [ 45.107033][ T2369] CPU: 1 PID: 2369 Comm: syz.3.923 Tainted: G B W syzkaller #0 [ 45.122380][ T2369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 45.181005][ T2369] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 45.197940][ T2369] Code: 04 01 48 c7 c7 c0 51 40 85 e8 bc 60 3b 02 0f 0b eb c3 e8 a3 8e 26 ff c6 05 52 73 82 04 01 48 c7 c7 20 52 40 85 e8 a0 60 3b 02 <0f> 0b eb a7 e8 87 8e 26 ff c6 05 33 73 82 04 01 48 c7 c7 40 51 40 [ 45.220722][ T2369] RSP: 0018:ffffc90001bbfc78 EFLAGS: 00010246 [ 45.235681][ T2369] RAX: e9fa1fbf2da09500 RBX: 0000000000000003 RCX: ffff88811fcdd000 [ 45.247771][ T2369] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 45.264173][ T2369] RBP: ffffc90001bbfc88 R08: ffff8881f7052fbf R09: 1ffff1103ee0a5f7 [ 45.276542][ T2369] R10: dffffc0000000000 R11: ffffed103ee0a5f8 R12: 00000000ffffffef [ 45.287595][ T2369] R13: dffffc0000000000 R14: 0000000000000003 R15: 00000000c0000000 [ 45.308593][ T2369] FS: 00007fe204a206c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 45.326760][ T2369] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.333847][ T2369] CR2: 00007f68f4d74580 CR3: 000000010f55d000 CR4: 00000000003506a0 [ 45.341941][ T2369] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 45.355385][ T2369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 45.372611][ T2369] Call Trace: [ 45.376131][ T2369] config_item_put+0x200/0x210 [ 45.381991][ T2369] configfs_symlink+0x4a6/0x1320 [ 45.389353][ T2369] ? show_sid+0x1b0/0x1b0 [ 45.393879][ T2369] ? __lookup_hash+0x122/0x250 [ 45.400632][ T2369] ? detach_groups+0x370/0x370 [ 45.408854][ T2369] ? selinux_inode_symlink+0x22/0x30 [ 45.417206][ T2369] ? security_inode_symlink+0xba/0x100 [ 45.423587][ T2369] vfs_symlink+0x339/0x4c0 [ 45.434730][ T2369] do_symlinkat+0x10e/0x3d0 [ 45.440299][ T2369] __x64_sys_symlinkat+0x7b/0x90 [ 45.449439][ T2369] do_syscall_64+0x31/0x40 [ 45.455354][ T2369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 45.463428][ T2369] RIP: 0033:0x7fe204bbee99 [ 45.468082][ T2369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 45.489769][ T2369] RSP: 002b:00007fe204a20028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 45.501947][ T2369] RAX: ffffffffffffffda RBX: 00007fe204e46fa0 RCX: 00007fe204bbee99 [ 45.512346][ T2369] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300 [ 45.521958][ T2369] RBP: 00007fe204c54eaf R08: 0000000000000000 R09: 0000000000000000 [ 45.545356][ T2369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 45.559411][ T2369] R13: 00007fe204e47038 R14: 00007fe204e46fa0 R15: 00007ffca951a328 [ 45.576163][ T2369] ---[ end trace 163e1479ef196855 ]--- 2026/09/08 20:24:56 executed programs: 1435 2026/09/08 20:25:01 executed programs: 2570