[ 27.747254][ T378] veth0_vlan: entered promiscuous mode [ 27.757046][ T378] veth1_macvtap: entered promiscuous mode [ 28.008500][ T12] bridge_slave_1: left allmulticast mode [ 28.014183][ T12] bridge_slave_1: left promiscuous mode [ 28.020296][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.028686][ T12] bridge_slave_0: left allmulticast mode [ 28.034436][ T12] bridge_slave_0: left promiscuous mode [ 28.041091][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.158959][ T12] veth1_macvtap: left promiscuous mode [ 28.164488][ T12] veth0_vlan: left promiscuous mode Warning: Permanently added '10.128.1.153' (ED25519) to the list of known hosts. 2026/10/19 23:06:51 parsed 1 programs 2026/10/19 23:06:51 serving rpc on tcp://36759 [ 37.468291][ T36] kauditd_printk_skb: 32 callbacks suppressed [ 37.468307][ T36] audit: type=1400 audit(1792451212.590:106): avc: denied { unlink } for pid=419 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 37.551162][ T419] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 38.792514][ T36] audit: type=1401 audit(1792451213.910:107): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 38.993172][ T36] audit: type=1400 audit(1792451214.110:108): avc: denied { create } for pid=468 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 39.152375][ T474] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.159454][ T474] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.167353][ T474] bridge_slave_0: entered allmulticast mode [ 39.174230][ T474] bridge_slave_0: entered promiscuous mode [ 39.180764][ T474] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.187847][ T474] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.194898][ T474] bridge_slave_1: entered allmulticast mode [ 39.201186][ T474] bridge_slave_1: entered promiscuous mode [ 39.242610][ T474] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.249666][ T474] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.256953][ T474] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.263979][ T474] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.283504][ T324] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.290833][ T324] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.300000][ T326] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.307061][ T326] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.316189][ T324] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.323293][ T324] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.346936][ T474] veth0_vlan: entered promiscuous mode [ 39.356553][ T474] veth1_macvtap: entered promiscuous mode [ 39.434173][ T13] bridge_slave_1: left allmulticast mode [ 39.446558][ T13] bridge_slave_1: left promiscuous mode [ 39.452260][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.459900][ T13] bridge_slave_0: left allmulticast mode [ 39.465555][ T13] bridge_slave_0: left promiscuous mode [ 39.471301][ T13] bridge0: port 1(bridge_slave_0) entered disabled state 2026/10/19 23:06:54 executed programs: 0 [ 39.560250][ T484] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.567523][ T484] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.574592][ T484] bridge_slave_0: entered allmulticast mode [ 39.580970][ T484] bridge_slave_0: entered promiscuous mode [ 39.588159][ T484] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.595203][ T484] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.602397][ T484] bridge_slave_1: entered allmulticast mode [ 39.608680][ T484] bridge_slave_1: entered promiscuous mode [ 39.617119][ T13] veth1_macvtap: left promiscuous mode [ 39.622599][ T13] veth0_vlan: left promiscuous mode [ 39.678103][ T484] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.685165][ T484] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.692450][ T484] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.699582][ T484] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.718963][ T324] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.726337][ T324] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.741625][ T324] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.748684][ T324] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.756311][ T324] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.763367][ T324] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.780725][ T484] veth0_vlan: entered promiscuous mode [ 39.790292][ T484] veth1_macvtap: entered promiscuous mode [ 39.817975][ T36] audit: type=1400 audit(1792451214.940:109): avc: denied { mount } for pid=488 comm="syz.2.17" name="/" dev="configfs" ino=932 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 39.836677][ T489] ================================================================== [ 39.840842][ T36] audit: type=1400 audit(1792451214.940:110): avc: denied { search } for pid=488 comm="syz.2.17" name="/" dev="configfs" ino=932 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 39.848367][ T489] BUG: KASAN: invalid-free in f_uac2_opts_p_srate_store+0x224/0x2b0 [ 39.848396][ T489] Free of addr ffff88811e15194c by task syz.2.17/489 [ 39.870463][ T36] audit: type=1400 audit(1792451214.940:111): avc: denied { write } for pid=488 comm="syz.2.17" name="usb_gadget" dev="configfs" ino=933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 39.878018][ T489] [ 39.878036][ T489] CPU: 1 UID: 0 PID: 489 Comm: syz.2.17 Not tainted syzkaller #0 175b1feda8704c59894b55aff61cb87015c3f4c0 [ 39.878060][ T489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 39.878078][ T489] Call Trace: [ 39.878085][ T489] [ 39.878092][ T489] __dump_stack+0x21/0x30 [ 39.878122][ T489] dump_stack_lvl+0x140/0x1c0 [ 39.878148][ T489] ? __cfi_dump_stack_lvl+0x10/0x10 [ 39.878174][ T489] print_address_description+0x71/0x210 [ 39.878200][ T489] print_report+0x4a/0x70 [ 39.878223][ T489] ? f_uac2_opts_p_srate_store+0x224/0x2b0 [ 39.878244][ T489] kasan_report_invalid_free+0x11e/0x160 [ 39.878264][ T489] ? f_uac2_opts_p_srate_store+0x224/0x2b0 [ 39.878283][ T489] ? f_uac2_opts_p_srate_store+0x224/0x2b0 [ 39.878302][ T489] check_slab_allocation+0xdf/0xf0 [ 39.878319][ T489] __kasan_slab_pre_free+0x36/0x50 [ 39.878335][ T489] kfree+0xf8/0x440 [ 39.878357][ T489] ? f_uac2_opts_p_srate_store+0x224/0x2b0 [ 39.878377][ T489] f_uac2_opts_p_srate_store+0x224/0x2b0 [ 39.878395][ T489] ? __cfi_f_uac2_opts_p_srate_store+0x10/0x10 [ 39.878415][ T489] ? down_read+0x7f/0xe0 [ 39.878436][ T489] ? __cfi_down_read+0x10/0x10 [ 39.878458][ T489] configfs_write_iter+0x32f/0x490 [ 39.878476][ T489] ? __cfi_f_uac2_opts_p_srate_store+0x10/0x10 [ 39.878496][ T489] vfs_write+0x762/0xfd0 [ 39.878520][ T489] ? __cfi_vfs_write+0x10/0x10 [ 39.878543][ T489] ? __cfi_mutex_lock+0x10/0x10 [ 39.878564][ T489] ksys_write+0x145/0x260 [ 39.878587][ T489] ? xfd_validate_state+0x68/0x140 [ 39.878611][ T489] ? __cfi_ksys_write+0x10/0x10 [ 39.878635][ T489] ? __kasan_check_write+0x18/0x20 [ 39.878657][ T489] ? fpregs_restore_userregs+0x11c/0x260 [ 39.878681][ T489] __x64_sys_write+0x7f/0x90 [ 39.878703][ T489] x64_sys_call+0x271c/0x2ee0 [ 39.878729][ T489] do_syscall_64+0x57/0xf0 [ 39.878745][ T489] ? clear_bhb_loop+0x50/0xa0 [ 39.878766][ T489] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.878787][ T489] RIP: 0033:0x7fb73b99df99 [ 39.878807][ T489] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.878822][ T489] RSP: 002b:00007fb73c8f4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 39.878849][ T489] RAX: ffffffffffffffda RBX: 00007fb73bc25fa0 RCX: 00007fb73b99df99 [ 39.878862][ T489] RDX: 0000000000000101 RSI: 0000200000000d40 RDI: 0000000000000003 [ 39.878874][ T489] RBP: 00007fb73ba34ec4 R08: 0000000000000000 R09: 0000000000000000 [ 39.878886][ T489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.878943][ T489] R13: 00007fb73bc26038 R14: 00007fb73bc25fa0 R15: 00007ffe69503bf8 [ 39.878958][ T489] [ 39.878964][ T489] [ 39.886624][ T36] audit: type=1400 audit(1792451214.940:112): avc: denied { add_name } for pid=488 comm="syz.2.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 39.907073][ T489] Allocated by task 489: [ 39.907086][ T489] kasan_save_track+0x3e/0x80 [ 39.907114][ T489] kasan_save_alloc_info+0x3a/0x50 [ 39.907131][ T489] __kasan_kmalloc+0x96/0xb0 [ 39.907145][ T489] __kmalloc_node_track_caller_noprof+0x24e/0x4f0 [ 39.907170][ T489] kstrdup+0x4d/0x130 [ 39.907187][ T489] f_uac2_opts_p_srate_store+0x11e/0x2b0 [ 39.910612][ T36] audit: type=1400 audit(1792451214.940:113): avc: denied { create } for pid=488 comm="syz.2.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 39.920746][ T489] configfs_write_iter+0x32f/0x490 [ 39.920768][ T489] vfs_write+0x762/0xfd0 [ 39.920789][ T489] ksys_write+0x145/0x260 [ 39.931135][ T36] audit: type=1400 audit(1792451214.940:114): avc: denied { write } for pid=488 comm="syz.2.17" name="p_srate" dev="configfs" ino=4825 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 39.934087][ T489] __x64_sys_write+0x7f/0x90 [ 39.937146][ T36] audit: type=1400 audit(1792451214.940:115): avc: denied { open } for pid=488 comm="syz.2.17" path="/0/config/usb_gadget/g1/functions/uac2.usb0/p_srate" dev="configfs" ino=4825 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 39.941305][ T489] x64_sys_call+0x271c/0x2ee0 [ 39.941326][ T489] do_syscall_64+0x57/0xf0 [ 40.325973][ T489] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.331891][ T489] [ 40.334195][ T489] The buggy address belongs to the object at ffff88811e151940 [ 40.334195][ T489] which belongs to the cache kmalloc-32 of size 32 [ 40.348142][ T489] The buggy address is located 12 bytes inside of [ 40.348142][ T489] 18-byte region [ffff88811e151940, ffff88811e151952) [ 40.361249][ T489] [ 40.363627][ T489] The buggy address belongs to the physical page: [ 40.370046][ T489] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11e151 [ 40.378878][ T489] flags: 0x4000000000000000(zone=1) [ 40.384057][ T489] page_type: f5(slab) [ 40.388029][ T489] raw: 4000000000000000 ffff888100041780 dead000000000100 dead000000000122 [ 40.396620][ T489] raw: 0000000000000000 0000000080400040 00000001f5000000 0000000000000000 [ 40.405289][ T489] page dumped because: kasan: bad access detected [ 40.411719][ T489] page_owner tracks the page as allocated [ 40.417416][ T489] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP), pid 110, tgid 110 (udevd), ts 5755549778, free_ts 0 [ 40.433819][ T489] post_alloc_hook+0x37d/0x3b0 [ 40.438571][ T489] prep_new_page+0x2d/0x180 [ 40.443055][ T489] get_page_from_freelist+0x4aea/0x4ba0 [ 40.448582][ T489] __alloc_pages_noprof+0x35a/0x7e0 [ 40.453761][ T489] alloc_slab_page+0x6b/0x1e0 [ 40.458417][ T489] allocate_slab+0x69/0x430 [ 40.462901][ T489] ___slab_alloc+0x591/0x8c0 [ 40.467473][ T489] __kmalloc_cache_noprof+0x2cd/0x470 [ 40.472842][ T489] kmem_cache_free+0x18d/0x4f0 [ 40.477595][ T489] __fput+0x71e/0xa30 [ 40.481624][ T489] __fput_sync+0x4a/0x70 [ 40.485864][ T489] __se_sys_close+0x172/0x1f0 [ 40.490529][ T489] __x64_sys_close+0x3c/0x60 [ 40.495124][ T489] x64_sys_call+0x2560/0x2ee0 [ 40.499803][ T489] do_syscall_64+0x57/0xf0 [ 40.504200][ T489] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.510078][ T489] page_owner free stack trace missing [ 40.515423][ T489] [ 40.517726][ T489] Memory state around the buggy address: [ 40.523409][ T489] ffff88811e151800: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 40.531478][ T489] ffff88811e151880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 40.539525][ T489] >ffff88811e151900: fa fb fb fb fc fc fc fc 00 00 02 fc fc fc fc fc [ 40.547569][ T489] ^ [ 40.553963][ T489] ffff88811e151980: 00 00 01 fc fc fc fc fc 00 00 01 fc fc fc fc fc [ 40.562103][ T489] ffff88811e151a00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 40.570146][ T489] ================================================================== [ 40.580287][ T489] Disabling lock debugging due to kernel taint 2026/10/19 23:06:59 executed programs: 237 2026/10/19 23:07:04 executed programs: 537