[ 74.362672][ T42] audit: type=1400 audit(1786955483.336:209): avc: denied { transition } for pid=5966 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 74.371552][ T42] audit: type=1400 audit(1786955483.346:210): avc: denied { noatsecure } for pid=5966 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 74.379239][ T42] audit: type=1400 audit(1786955483.346:211): avc: denied { rlimitinh } for pid=5966 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 74.386817][ T42] audit: type=1400 audit(1786955483.346:212): avc: denied { siginh } for pid=5966 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 78.732901][ T42] audit: type=1400 audit(1786955487.706:213): avc: denied { write } for pid=5972 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 78.782894][ T42] audit: type=1400 audit(1786955487.756:214): avc: denied { write } for pid=5975 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 78.872155][ T42] audit: type=1400 audit(1786955487.846:215): avc: denied { write } for pid=5978 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 78.928339][ T42] audit: type=1400 audit(1786955487.896:216): avc: denied { write } for pid=5981 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 79.736903][ T42] audit: type=1400 audit(1786955488.706:217): avc: denied { write } for pid=5984 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 79.796565][ T42] audit: type=1400 audit(1786955488.766:218): avc: denied { write } for pid=5987 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 79.967419][ T42] audit: type=1400 audit(1786955488.936:219): avc: denied { write } for pid=5990 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 80.025122][ T42] audit: type=1400 audit(1786955488.996:220): avc: denied { write } for pid=5993 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:63247' (ED25519) to the list of known hosts. [ 81.651597][ T34] cfg80211: failed to load regulatory.db 2026/08/17 08:31:30 parsed 1 programs 2026/08/17 08:31:30 serving rpc on tcp://33265 [ 84.500853][ T42] audit: type=1400 audit(1786955493.476:221): avc: denied { read write } for pid=6014 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 84.510250][ T42] audit: type=1400 audit(1786955493.476:222): avc: denied { open } for pid=6014 comm="syz-executor" path="/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 84.602689][ T42] audit: type=1400 audit(1786955493.576:223): avc: denied { unlink } for pid=6014 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 85.008439][ T42] audit: type=1400 audit(1786955493.976:224): avc: denied { relabelto } for pid=6017 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 85.671935][ T6014] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 87.564835][ T1156] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.568043][ T1156] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.582975][ T72] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.585772][ T72] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.014188][ T5087] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 89.028541][ T5843] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 89.032228][ T5843] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 89.036132][ T5843] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 89.038787][ T5843] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 89.526229][ T42] audit: type=1400 audit(1786955498.496:225): avc: denied { sys_module } for pid=6077 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 89.870432][ T6077] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.876016][ T6077] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.878611][ T6077] bridge_slave_0: entered allmulticast mode [ 89.881699][ T6077] bridge_slave_0: entered promiscuous mode [ 89.886207][ T6077] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.888740][ T6077] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.891265][ T6077] bridge_slave_1: entered allmulticast mode [ 89.894033][ T6077] bridge_slave_1: entered promiscuous mode [ 89.910201][ T6077] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.914527][ T6077] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.930126][ T6077] team0: Port device team_slave_0 added [ 89.933197][ T6077] team0: Port device team_slave_1 added [ 89.949685][ T6077] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.951833][ T6077] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.960148][ T6077] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.964440][ T6077] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.966729][ T6077] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.975285][ T6077] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.014372][ T6077] hsr_slave_0: entered promiscuous mode [ 90.017715][ T6077] hsr_slave_1: entered promiscuous mode [ 90.164084][ T42] audit: type=1400 audit(1786955499.136:226): avc: denied { write } for pid=6093 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.215996][ T42] audit: type=1400 audit(1786955499.186:227): avc: denied { write } for pid=6096 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.301798][ T42] audit: type=1400 audit(1786955499.276:228): avc: denied { write } for pid=6098 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.353980][ T42] audit: type=1400 audit(1786955499.326:229): avc: denied { write } for pid=6101 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.429953][ T42] audit: type=1400 audit(1786955499.406:230): avc: denied { write } for pid=6103 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.474316][ T42] audit: type=1400 audit(1786955499.446:231): avc: denied { write } for pid=6106 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.553338][ T42] audit: type=1400 audit(1786955499.526:232): avc: denied { write } for pid=6108 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.584306][ T6077] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 90.590765][ T6077] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 90.594525][ T6077] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 90.601356][ T6077] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 90.604967][ T6077] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 90.608960][ T6077] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 90.611923][ T6077] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.616745][ T6077] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 90.620406][ T42] audit: type=1400 audit(1786955499.596:233): avc: denied { write } for pid=6111 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.637445][ T6077] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.640430][ T6077] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.643571][ T6077] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.646404][ T6077] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.697115][ T6077] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.708459][ T38] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.712857][ T38] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.715640][ T42] audit: type=1400 audit(1786955499.686:234): avc: denied { write } for pid=6119 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 90.733703][ T6077] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.744002][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.747269][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.758507][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.761803][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.783294][ T42] audit: type=1400 audit(1786955499.756:235): avc: denied { write } for pid=6122 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.069766][ T6077] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.108767][ T6077] veth0_vlan: entered promiscuous mode [ 91.125652][ T6077] veth1_vlan: entered promiscuous mode [ 91.145999][ T6077] veth0_macvtap: entered promiscuous mode [ 91.150628][ T6077] veth1_macvtap: entered promiscuous mode [ 91.164427][ T6077] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.175926][ T6077] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.202046][ T5874] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.205432][ T5874] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.249645][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.252936][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.301379][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.357267][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.458055][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.559188][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/08/17 08:31:41 executed programs: 0 [ 92.127655][ T64] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 92.133105][ T64] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 92.136071][ T64] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 92.140993][ T64] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 92.143757][ T64] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 92.479808][ T6194] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.482902][ T6194] bridge0: port 1(bridge_slave_0) entered disabled state [ 92.486035][ T6194] bridge_slave_0: entered allmulticast mode [ 92.490260][ T6194] bridge_slave_0: entered promiscuous mode [ 92.495091][ T6194] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.498193][ T6194] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.501370][ T6194] bridge_slave_1: entered allmulticast mode [ 92.505265][ T6194] bridge_slave_1: entered promiscuous mode [ 92.533232][ T6194] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 92.541386][ T6194] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.569473][ T6194] team0: Port device team_slave_0 added [ 92.574680][ T6194] team0: Port device team_slave_1 added [ 92.598832][ T6194] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.601686][ T6194] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.611627][ T6194] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.618200][ T6194] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.620986][ T6194] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.631718][ T6194] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.672184][ T6194] hsr_slave_0: entered promiscuous mode [ 92.675212][ T6194] hsr_slave_1: entered promiscuous mode [ 92.678232][ T6194] debugfs: 'hsr0' already exists in 'hsr' [ 92.680713][ T6194] Cannot create hsr debugfs directory [ 93.857504][ T12] bridge_slave_1: left allmulticast mode [ 93.859871][ T12] bridge_slave_1: left promiscuous mode [ 93.862249][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.866520][ T12] bridge_slave_0: left allmulticast mode [ 93.868351][ T12] bridge_slave_0: left promiscuous mode [ 93.870465][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.950842][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 93.956642][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 93.962173][ T12] bond0 (unregistering): Released all slaves [ 94.106298][ T12] hsr_slave_0: left promiscuous mode [ 94.109238][ T12] hsr_slave_1: left promiscuous mode [ 94.112483][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 94.115630][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 94.119143][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 94.121980][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 94.130802][ T12] veth1_macvtap: left promiscuous mode [ 94.133227][ T12] veth0_macvtap: left promiscuous mode [ 94.135553][ T12] veth1_vlan: left promiscuous mode [ 94.137838][ T12] veth0_vlan: left promiscuous mode [ 94.209696][ T5843] Bluetooth: hci0: command tx timeout [ 94.311879][ T12] team0 (unregistering): Port device team_slave_1 removed [ 94.319131][ T12] team0 (unregistering): Port device team_slave_0 removed [ 94.385027][ T5440] 8021q: adding VLAN 0 to HW filter on device eth2 [ 94.714435][ T6194] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 94.722971][ T6194] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.726920][ T6194] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 94.733025][ T6194] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.736527][ T6194] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 94.748187][ T6194] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.752832][ T6194] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 94.765808][ T6194] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.807031][ T6194] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.816297][ T6194] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.821679][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.824045][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.830001][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.832779][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.232309][ T6194] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.278039][ T6194] veth0_vlan: entered promiscuous mode [ 95.285193][ T6194] veth1_vlan: entered promiscuous mode [ 95.311043][ T6194] veth0_macvtap: entered promiscuous mode [ 95.318904][ T6194] veth1_macvtap: entered promiscuous mode [ 95.330727][ T6194] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.339324][ T6194] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.371234][ T5874] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.375345][ T5874] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.391241][ T1157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.394230][ T1157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.412290][ T1156] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.415381][ T1156] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.429676][ T5874] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.433161][ T5874] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.455197][ T42] kauditd_printk_skb: 23 callbacks suppressed [ 95.455208][ T42] audit: type=1400 audit(1786955504.426:259): avc: denied { create } for pid=6251 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 95.466513][ T42] audit: type=1400 audit(1786955504.426:260): avc: denied { write } for pid=6251 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 95.474448][ T42] audit: type=1400 audit(1786955504.426:261): avc: denied { nlmsg_write } for pid=6251 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 95.511112][ T6255] [ 95.512264][ T6255] ============================= [ 95.513903][ T6255] WARNING: suspicious RCU usage [ 95.515412][ T6255] syzkaller #0 Not tainted [ 95.516828][ T6255] ----------------------------- [ 95.518442][ T6255] net/xfrm/xfrm_user.c:1630 suspicious rcu_dereference_check() usage! [ 95.521100][ T6255] [ 95.521100][ T6255] other info that might help us debug this: [ 95.521100][ T6255] [ 95.524195][ T6255] [ 95.524195][ T6255] rcu_scheduler_active = 2, debug_locks = 1 [ 95.526662][ T6255] 1 lock held by syz.0.17/6255: [ 95.528184][ T6255] #0: ffff88802dca9c50 (&net->xfrm.xfrm_cfg_mutex){+.+.}-{4:4}, at: xfrm_netlink_rcv+0x62/0x90 [ 95.531517][ T6255] [ 95.531517][ T6255] stack backtrace: [ 95.533294][ T6255] CPU: 3 UID: 0 PID: 6255 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 95.533308][ T6255] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.533324][ T6255] Call Trace: [ 95.533344][ T6255] [ 95.533349][ T6255] dump_stack_lvl+0x100/0x190 [ 95.533366][ T6255] lockdep_rcu_suspicious.cold+0x4f/0xb1 [ 95.533390][ T6255] xfrm_do_migrate_state+0x2463/0x2f10 [ 95.533410][ T6255] ? __pfx_xfrm_do_migrate_state+0x10/0x10 [ 95.533425][ T6255] ? __asan_memset+0x23/0x50 [ 95.533436][ T6255] ? __nla_validate_parse+0x1e7/0x28b0 [ 95.533456][ T6255] ? __nla_parse+0x40/0x60 [ 95.533465][ T6255] ? __pfx_xfrm_do_migrate_state+0x10/0x10 [ 95.533481][ T6255] ? xfrm_user_rcv_msg+0x483/0xd80 [ 95.533492][ T6255] xfrm_user_rcv_msg+0x483/0xd80 [ 95.533507][ T6255] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 95.533518][ T6255] ? lockdep_hardirqs_on+0x78/0x100 [ 95.533532][ T6255] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 95.533550][ T6255] ? rcu_is_watching+0x12/0xc0 [ 95.533578][ T6255] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 95.533589][ T6255] ? __mutex_lock+0x82c/0x1bd0 [ 95.533601][ T6255] ? lockdep_hardirqs_on+0x78/0x100 [ 95.533613][ T6255] ? __mutex_lock+0x82c/0x1bd0 [ 95.533624][ T6255] ? __mutex_lock+0x26d/0x1bd0 [ 95.533637][ T6255] netlink_rcv_skb+0x159/0x420 [ 95.533651][ T6255] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 95.533664][ T6255] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 95.533682][ T6255] xfrm_netlink_rcv+0x71/0x90 [ 95.533694][ T6255] netlink_unicast+0x585/0x850 [ 95.533707][ T6255] ? __pfx_netlink_unicast+0x10/0x10 [ 95.533719][ T6255] ? __pfx_sock_has_perm+0x10/0x10 [ 95.533736][ T6255] netlink_sendmsg+0x8b0/0xda0 [ 95.533749][ T6255] ? __pfx_netlink_sendmsg+0x10/0x10 [ 95.533761][ T6255] ? selinux_socket_sendmsg+0x198/0x2f0 [ 95.533778][ T6255] ____sys_sendmsg+0xa4d/0xbe0 [ 95.533788][ T6255] ? __pfx_netlink_sendmsg+0x10/0x10 [ 95.533801][ T6255] ? __pfx_____sys_sendmsg+0x10/0x10 [ 95.533816][ T6255] ___sys_sendmsg+0x190/0x1e0 [ 95.533827][ T6255] ? __pfx____sys_sendmsg+0x10/0x10 [ 95.533837][ T6255] ? __lock_acquire+0x49f/0x1a40 [ 95.533863][ T6255] __sys_sendmsg+0x160/0x210 [ 95.533878][ T6255] ? __pfx___sys_sendmsg+0x10/0x10 [ 95.533898][ T6255] do_syscall_64+0x115/0x870 [ 95.533910][ T6255] ? clear_bhb_loop+0x70/0xc0 [ 95.533923][ T6255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.533935][ T6255] RIP: 0033:0x7f100759e019 [ 95.533945][ T6255] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.533955][ T6255] RSP: 002b:00007f10084b4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 95.533966][ T6255] RAX: ffffffffffffffda RBX: 00007f1007826090 RCX: 00007f100759e019 [ 95.533973][ T6255] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000003 [ 95.533979][ T6255] RBP: 00007f100763500c R08: 0000000000000000 R09: 0000000000000000 [ 95.533985][ T6255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.533990][ T6255] R13: 00007f1007826128 R14: 00007f1007826090 R15: 00007fff292d76e8 [ 95.534003][ T6255] [ 96.299583][ T5843] Bluetooth: hci0: command tx timeout 2026/08/17 08:31:46 executed programs: 73 [ 98.369594][ T5843] Bluetooth: hci0: command tx timeout [ 100.449854][ T5843] Bluetooth: hci0: command tx timeout 2026/08/17 08:31:51 executed programs: 318