Warning: Permanently added '10.128.0.45' (ED25519) to the list of known hosts. 2026/08/16 23:00:01 parsed 1 programs 2026/08/16 23:00:01 serving rpc on tcp://42153 Setting up swapspace version 1, size = 127995904 bytes [ 35.707967][ T36] kauditd_printk_skb: 32 callbacks suppressed [ 35.707983][ T36] audit: type=1400 audit(1786921202.639:106): avc: denied { unlink } for pid=422 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 35.781452][ T422] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 36.852395][ T36] audit: type=1401 audit(1786921203.779:107): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 36.993384][ T36] audit: type=1400 audit(1786921203.909:108): avc: denied { create } for pid=455 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.200257][ T458] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.210969][ T458] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.218470][ T458] bridge_slave_0: entered allmulticast mode [ 37.226606][ T458] bridge_slave_0: entered promiscuous mode [ 37.234045][ T458] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.241119][ T458] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.248319][ T458] bridge_slave_1: entered allmulticast mode [ 37.254626][ T458] bridge_slave_1: entered promiscuous mode [ 37.488690][ T458] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.495947][ T458] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.503393][ T458] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.511076][ T458] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.542006][ T334] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.550174][ T334] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.584026][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.591131][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.599903][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.606976][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.625797][ T458] veth0_vlan: entered promiscuous mode 2026/08/16 23:00:04 executed programs: 0 [ 37.635759][ T458] veth1_macvtap: entered promiscuous mode [ 37.761716][ T46] bridge_slave_1: left allmulticast mode [ 37.767432][ T46] bridge_slave_1: left promiscuous mode [ 37.773031][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.780798][ T46] bridge_slave_0: left allmulticast mode [ 37.786455][ T46] bridge_slave_0: left promiscuous mode [ 37.792211][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.935084][ T493] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.944262][ T493] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.951432][ T493] bridge_slave_0: entered allmulticast mode [ 37.957948][ T493] bridge_slave_0: entered promiscuous mode [ 37.964354][ T492] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.971430][ T492] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.978599][ T492] bridge_slave_0: entered allmulticast mode [ 37.984828][ T492] bridge_slave_0: entered promiscuous mode [ 37.994065][ T492] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.001129][ T492] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.008268][ T492] bridge_slave_1: entered allmulticast mode [ 38.014510][ T492] bridge_slave_1: entered promiscuous mode [ 38.022508][ T493] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.029860][ T493] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.036997][ T493] bridge_slave_1: entered allmulticast mode [ 38.043143][ T493] bridge_slave_1: entered promiscuous mode [ 38.058938][ T46] veth1_macvtap: left promiscuous mode [ 38.064554][ T46] veth0_vlan: left promiscuous mode [ 38.115310][ T494] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.122543][ T494] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.129687][ T494] bridge_slave_0: entered allmulticast mode [ 38.135936][ T494] bridge_slave_0: entered promiscuous mode [ 38.143377][ T494] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.151372][ T494] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.158704][ T494] bridge_slave_1: entered allmulticast mode [ 38.165032][ T494] bridge_slave_1: entered promiscuous mode [ 38.171104][ T495] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.178292][ T495] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.185638][ T495] bridge_slave_0: entered allmulticast mode [ 38.191906][ T495] bridge_slave_0: entered promiscuous mode [ 38.210132][ T495] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.217341][ T495] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.224463][ T495] bridge_slave_1: entered allmulticast mode [ 38.231154][ T495] bridge_slave_1: entered promiscuous mode [ 38.417544][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.424783][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.439702][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.446864][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.482244][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.489417][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.509300][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.516354][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.524291][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.531444][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.539544][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.546645][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.565283][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.572372][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.583814][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.590890][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.611367][ T493] veth0_vlan: entered promiscuous mode [ 38.620725][ T495] veth0_vlan: entered promiscuous mode [ 38.635159][ T493] veth1_macvtap: entered promiscuous mode [ 38.649346][ T495] veth1_macvtap: entered promiscuous mode [ 38.660631][ T492] veth0_vlan: entered promiscuous mode [ 38.685487][ T492] veth1_macvtap: entered promiscuous mode [ 38.714855][ T494] veth0_vlan: entered promiscuous mode [ 38.721051][ T36] audit: type=1400 audit(1786921205.649:109): avc: denied { mount } for pid=509 comm="syz.1.18" name="/" dev="configfs" ino=1132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 38.743840][ T36] audit: type=1400 audit(1786921205.659:110): avc: denied { search } for pid=509 comm="syz.1.18" name="/" dev="configfs" ino=1132 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 38.768073][ T36] audit: type=1400 audit(1786921205.659:111): avc: denied { write } for pid=509 comm="syz.1.18" name="usb_gadget" dev="configfs" ino=1133 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 38.782323][ T494] veth1_macvtap: entered promiscuous mode [ 38.810785][ T36] audit: type=1400 audit(1786921205.659:112): avc: denied { add_name } for pid=509 comm="syz.1.18" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 38.832204][ T36] audit: type=1400 audit(1786921205.659:113): avc: denied { create } for pid=509 comm="syz.1.18" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 38.852243][ T36] audit: type=1400 audit(1786921205.659:114): avc: denied { create } for pid=509 comm="syz.1.18" name="uac2.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 38.874226][ T36] audit: type=1400 audit(1786921205.659:115): avc: denied { remove_name } for pid=509 comm="syz.1.18" name="uac2.usb0" dev="configfs" ino=4977 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 40.924238][ T1160] ================================================================== [ 40.932466][ T1160] BUG: KASAN: slab-use-after-free in config_item_get+0x2b/0xa0 [ 40.940022][ T1160] Write of size 4 at addr ffff88810979601c by task syz.1.341/1160 [ 40.948337][ T1160] [ 40.954069][ T1160] CPU: 1 UID: 0 PID: 1160 Comm: syz.1.341 Not tainted syzkaller #0 2199c05e8c8709f558a4dfaebe1341036c542208 [ 40.954087][ T1160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 40.954101][ T1160] Call Trace: [ 40.954107][ T1160] [ 40.954114][ T1160] __dump_stack+0x21/0x30 [ 40.954133][ T1160] dump_stack_lvl+0x140/0x1c0 [ 40.954147][ T1160] ? __cfi_dump_stack_lvl+0x10/0x10 [ 40.954162][ T1160] ? __cfi__printk+0x10/0x10 [ 40.954188][ T1160] print_address_description+0x71/0x210 [ 40.954203][ T1160] print_report+0x4a/0x70 [ 40.954216][ T1160] kasan_report+0x162/0x1a0 [ 40.954230][ T1160] ? config_item_get+0x2b/0xa0 [ 40.954247][ T1160] ? __kasan_check_write+0x18/0x20 [ 40.954258][ T1160] ? config_item_get+0x2b/0xa0 [ 40.954272][ T1160] kasan_check_range+0x25a/0x2b0 [ 40.954285][ T1160] __kasan_check_write+0x18/0x20 [ 40.954294][ T1160] config_item_get+0x2b/0xa0 [ 40.954308][ T1160] configfs_symlink+0x455/0x1050 [ 40.954323][ T1160] ? generic_permission+0x1ec/0x590 [ 40.954336][ T1160] ? __cfi_configfs_symlink+0x10/0x10 [ 40.954350][ T1160] ? selinux_inode_symlink+0x26/0x30 [ 40.954365][ T1160] ? bpf_lsm_inode_symlink+0xd/0x20 [ 40.954377][ T1160] ? security_inode_symlink+0x7e/0x170 [ 40.954391][ T1160] vfs_symlink+0x3f4/0x620 [ 40.954407][ T1160] do_symlinkat+0x1ba/0x400 [ 40.954444][ T1160] ? __cfi_do_symlinkat+0x10/0x10 [ 40.954458][ T1160] ? __kasan_check_write+0x18/0x20 [ 40.954468][ T1160] ? getname_flags+0x203/0x6b0 [ 40.954478][ T1160] ? __kasan_check_write+0x18/0x20 [ 40.954488][ T1160] __x64_sys_symlinkat+0x99/0xb0 [ 40.954502][ T1160] x64_sys_call+0x1f79/0x2ee0 [ 40.954512][ T1160] do_syscall_64+0x57/0xf0 [ 40.954526][ T1160] ? clear_bhb_loop+0x50/0xa0 [ 40.954542][ T1160] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.954556][ T1160] RIP: 0033:0x7f216279df99 [ 40.954568][ T1160] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.954577][ T1160] RSP: 002b:00007f21635ca028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 40.954595][ T1160] RAX: ffffffffffffffda RBX: 00007f2162a25fa0 RCX: 00007f216279df99 [ 40.954609][ T1160] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300 [ 40.954620][ T1160] RBP: 00007f2162834ec4 R08: 0000000000000000 R09: 0000000000000000 [ 40.954629][ T1160] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.954636][ T1160] R13: 00007f2162a26038 R14: 00007f2162a25fa0 R15: 00007ffc78c94af8 [ 40.954645][ T1160] [ 40.954649][ T1160] [ 41.209872][ T1160] Allocated by task 1157: [ 41.214288][ T1160] kasan_save_track+0x3e/0x80 [ 41.219074][ T1160] kasan_save_alloc_info+0x3a/0x50 [ 41.224199][ T1160] __kasan_kmalloc+0x96/0xb0 [ 41.229131][ T1160] __kmalloc_cache_noprof+0x23c/0x470 [ 41.234502][ T1160] afunc_alloc_inst+0x5e/0x810 [ 41.239364][ T1160] usb_get_function_instance+0xfa/0x320 [ 41.245278][ T1160] function_make+0x125/0x370 [ 41.249984][ T1160] configfs_mkdir+0x526/0xb70 [ 41.254951][ T1160] vfs_mkdir+0x591/0x810 [ 41.259252][ T1160] do_mkdirat+0x240/0x530 [ 41.263583][ T1160] __x64_sys_mkdirat+0x8b/0xa0 [ 41.268355][ T1160] x64_sys_call+0x2ba8/0x2ee0 [ 41.273083][ T1160] do_syscall_64+0x57/0xf0 [ 41.277695][ T1160] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.283699][ T1160] [ 41.286028][ T1160] Freed by task 1157: [ 41.290013][ T1160] kasan_save_track+0x3e/0x80 [ 41.294715][ T1160] kasan_save_free_info+0x44/0x50 [ 41.299762][ T1160] __kasan_slab_free+0x5f/0x80 [ 41.304535][ T1160] kfree+0x158/0x440 [ 41.308423][ T1160] afunc_free_inst+0x19/0x30 [ 41.312997][ T1160] usb_put_function_instance+0x9f/0xc0 [ 41.318441][ T1160] f_uac2_attr_release+0x19/0x30 [ 41.323466][ T1160] config_item_put+0x178/0x240 [ 41.328262][ T1160] configfs_rmdir+0x8e8/0x9b0 [ 41.332945][ T1160] vfs_rmdir+0x3de/0x560 [ 41.337215][ T1160] do_rmdir+0x29a/0x590 [ 41.341388][ T1160] __x64_sys_unlinkat+0xc9/0xf0 [ 41.346252][ T1160] x64_sys_call+0x2974/0x2ee0 [ 41.351023][ T1160] do_syscall_64+0x57/0xf0 [ 41.355433][ T1160] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.361345][ T1160] [ 41.363724][ T1160] The buggy address belongs to the object at ffff888109796000 [ 41.363724][ T1160] which belongs to the cache kmalloc-2k of size 2048 [ 41.377770][ T1160] The buggy address is located 28 bytes inside of [ 41.377770][ T1160] freed 2048-byte region [ffff888109796000, ffff888109796800) [ 41.391662][ T1160] [ 41.394017][ T1160] The buggy address belongs to the physical page: [ 41.400453][ T1160] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109790 [ 41.409489][ T1160] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 41.418075][ T1160] flags: 0x4000000000000040(head|zone=1) [ 41.423719][ T1160] page_type: f5(slab) [ 41.427823][ T1160] raw: 4000000000000040 ffff888100042000 dead000000000100 dead000000000122 [ 41.436417][ T1160] raw: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000 [ 41.445038][ T1160] head: 4000000000000040 ffff888100042000 dead000000000100 dead000000000122 [ 41.453747][ T1160] head: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000 [ 41.462433][ T1160] head: 4000000000000003 ffffea000425e401 ffffffffffffffff 0000000000000000 [ 41.471107][ T1160] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 41.479773][ T1160] page dumped because: kasan: bad access detected [ 41.486191][ T1160] page_owner tracks the page as allocated [ 41.491914][ T1160] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 321, tgid 321 (syz-executor), ts 24513095917, free_ts 24438815861 [ 41.514571][ T1160] post_alloc_hook+0x37d/0x3b0 [ 41.519350][ T1160] prep_new_page+0x2d/0x180 [ 41.523893][ T1160] get_page_from_freelist+0x4aea/0x4ba0 [ 41.529690][ T1160] __alloc_pages_noprof+0x35a/0x7e0 [ 41.534980][ T1160] alloc_slab_page+0x6b/0x1e0 [ 41.539688][ T1160] allocate_slab+0x69/0x430 [ 41.544192][ T1160] ___slab_alloc+0x591/0x8c0 [ 41.548796][ T1160] __kmalloc_cache_noprof+0x2cd/0x470 [ 41.554176][ T1160] rtnl_newlink+0x115/0x2220 [ 41.558785][ T1160] rtnetlink_rcv_msg+0x8c1/0xa40 [ 41.563732][ T1160] netlink_rcv_skb+0x24d/0x4e0 [ 41.568491][ T1160] rtnetlink_rcv+0x20/0x30 [ 41.572917][ T1160] netlink_unicast+0x8bf/0xa70 [ 41.577672][ T1160] netlink_sendmsg+0x7d1/0xad0 [ 41.582442][ T1160] __sys_sendto+0x68d/0x700 [ 41.586948][ T1160] __x64_sys_sendto+0xe9/0x100 [ 41.591773][ T1160] page last free pid 320 tgid 320 stack trace: [ 41.597934][ T1160] free_unref_page+0xbb8/0xf70 [ 41.602740][ T1160] __free_pages+0x6b/0x3b0 [ 41.607194][ T1160] __free_slab+0xb2/0x110 [ 41.611627][ T1160] free_slab+0x18/0xe0 [ 41.615704][ T1160] __put_partials+0x115/0x150 [ 41.620369][ T1160] put_cpu_partial+0x91/0xc0 [ 41.624944][ T1160] __slab_free+0x1cf/0x2a0 [ 41.629442][ T1160] ___cache_free+0xc9/0xe0 [ 41.634060][ T1160] qlist_free_all+0xb5/0x130 [ 41.638654][ T1160] kasan_quarantine_reduce+0x14f/0x180 [ 41.644112][ T1160] __kasan_slab_alloc+0x28/0x90 [ 41.649045][ T1160] __kmalloc_cache_noprof+0x1d9/0x470 [ 41.654437][ T1160] kset_create_and_add+0x6b/0x210 [ 41.659630][ T1160] netdev_register_kobject+0x1c6/0x330 [ 41.665079][ T1160] register_netdevice+0x1042/0x1a80 [ 41.670889][ T1160] register_netdev+0x42/0x60 [ 41.675553][ T1160] [ 41.677896][ T1160] Memory state around the buggy address: [ 41.683680][ T1160] ffff888109795f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.691723][ T1160] ffff888109795f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.699778][ T1160] >ffff888109796000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.707827][ T1160] ^ [ 41.712657][ T1160] ffff888109796080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.720798][ T1160] ffff888109796100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 41.729037][ T1160] ================================================================== [ 41.737371][ T1160] Disabling lock debugging due to kernel taint [ 41.743520][ T1160] ------------[ cut here ]------------ [ 41.749074][ T1160] refcount_t: addition on 0; use-after-free. [ 41.755253][ T1160] WARNING: CPU: 1 PID: 1160 at lib/refcount.c:25 refcount_warn_saturate+0xfd/0x1c0 [ 41.764649][ T1160] Modules linked in: [ 41.768562][ T1160] CPU: 1 UID: 0 PID: 1160 Comm: syz.1.341 Tainted: G B syzkaller #0 2199c05e8c8709f558a4dfaebe1341036c542208 [ 41.781753][ T1160] Tainted: [B]=BAD_PAGE [ 41.786594][ T1160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 41.797170][ T1160] RIP: 0010:refcount_warn_saturate+0xfd/0x1c0 [ 41.803667][ T1160] Code: 00 00 00 e8 b5 8d d8 fe 5b 41 5e 5d e9 cc da f7 02 cc e8 a6 8d d8 fe c6 05 23 6a 36 05 01 48 c7 c7 40 ee 51 86 e8 c3 65 55 fe <0f> 0b eb da e8 8a 8d d8 fe c6 05 08 6a 36 05 01 48 c7 c7 a0 ee 51 [ 41.823583][ T1160] RSP: 0018:ffffc9000414fc38 EFLAGS: 00010246 [ 41.829771][ T1160] RAX: e223752fd92f8600 RBX: 0000000000000002 RCX: ffff8881156ba600 [ 41.837769][ T1160] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 41.845847][ T1160] RBP: ffffc9000414fc48 R08: 0000000000000003 R09: 0000000000000004 [ 41.853857][ T1160] R10: dffffc0000000000 R11: fffffbfff0e9f34c R12: ffff8881205a9fa8 [ 41.862090][ T1160] R13: dffffc0000000000 R14: ffff88810979601c R15: 0000000000000000 [ 41.870124][ T1160] FS: 00007f21635ca6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 41.879215][ T1160] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.885793][ T1160] CR2: 0000001b33563fff CR3: 000000012e7c8000 CR4: 00000000003526b0 [ 41.893797][ T1160] Call Trace: [ 41.897085][ T1160] [ 41.900117][ T1160] config_item_get+0x95/0xa0 [ 41.904764][ T1160] configfs_symlink+0x455/0x1050 [ 41.910026][ T1160] ? generic_permission+0x1ec/0x590 [ 41.915256][ T1160] ? __cfi_configfs_symlink+0x10/0x10 [ 41.920663][ T1160] ? selinux_inode_symlink+0x26/0x30 [ 41.925948][ T1160] ? bpf_lsm_inode_symlink+0xd/0x20 [ 41.931164][ T1160] ? security_inode_symlink+0x7e/0x170 [ 41.936713][ T1160] vfs_symlink+0x3f4/0x620 [ 41.941301][ T1160] do_symlinkat+0x1ba/0x400 [ 41.945966][ T1160] ? __cfi_do_symlinkat+0x10/0x10 [ 41.951067][ T1160] ? __kasan_check_write+0x18/0x20 [ 41.956386][ T1160] ? getname_flags+0x203/0x6b0 [ 41.961205][ T1160] ? __kasan_check_write+0x18/0x20 [ 41.966310][ T1160] __x64_sys_symlinkat+0x99/0xb0 [ 41.971256][ T1160] x64_sys_call+0x1f79/0x2ee0 [ 41.975916][ T1160] do_syscall_64+0x57/0xf0 [ 41.980358][ T1160] ? clear_bhb_loop+0x50/0xa0 [ 41.985038][ T1160] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.990951][ T1160] RIP: 0033:0x7f216279df99 [ 41.995346][ T1160] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.014989][ T1160] RSP: 002b:00007f21635ca028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 42.023418][ T1160] RAX: ffffffffffffffda RBX: 00007f2162a25fa0 RCX: 00007f216279df99 [ 42.031392][ T1160] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300 [ 42.039410][ T1160] RBP: 00007f2162834ec4 R08: 0000000000000000 R09: 0000000000000000 [ 42.047572][ T1160] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 42.055546][ T1160] R13: 00007f2162a26038 R14: 00007f2162a25fa0 R15: 00007ffc78c94af8 [ 42.063579][ T1160] [ 42.066715][ T1160] ---[ end trace 0000000000000000 ]--- [ 42.081699][ T1160] ------------[ cut here ]------------ [ 42.087271][ T1160] refcount_t: underflow; use-after-free. [ 42.091451][ T36] kauditd_printk_skb: 4 callbacks suppressed [ 42.091466][ T36] audit: type=1400 audit(1786921209.009:120): avc: denied { read } for pid=93 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 42.096479][ T1160] WARNING: CPU: 1 PID: 1160 at lib/refcount.c:28 refcount_warn_saturate+0x119/0x1c0 [ 42.106534][ T36] audit: type=1400 audit(1786921209.009:121): avc: denied { search } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 42.120810][ T1160] Modules linked in: [ 42.136716][ T36] audit: type=1400 audit(1786921209.009:122): avc: denied { write } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 42.151797][ T1160] [ 42.166360][ T36] audit: type=1400 audit(1786921209.009:123): avc: denied { add_name } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 42.177091][ T1160] CPU: 1 UID: 0 PID: 1160 Comm: syz.1.341 Tainted: G B W syzkaller #0 2199c05e8c8709f558a4dfaebe1341036c542208 [ 42.181507][ T36] audit: type=1400 audit(1786921209.009:124): avc: denied { create } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 42.199942][ T1160] Tainted: [B]=BAD_PAGE, [W]=WARN [ 42.214224][ T36] audit: type=1400 audit(1786921209.009:125): avc: denied { append open } for pid=93 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 42.233182][ T1160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.233198][ T1160] RIP: 0010:refcount_warn_saturate+0x119/0x1c0 [ 42.233236][ T1160] Code: 05 01 48 c7 c7 40 ee 51 86 e8 c3 65 55 fe 0f 0b eb da e8 8a 8d d8 fe c6 05 08 6a 36 05 01 48 c7 c7 a0 ee 51 86 e8 a7 65 55 fe <0f> 0b eb be e8 6e 8d d8 fe c6 05 e9 69 36 05 01 48 c7 c7 e0 ed 51 [ 42.233250][ T1160] RSP: 0018:ffffc9000414fc18 EFLAGS: 00010246 [ 42.239340][ T36] audit: type=1400 audit(1786921209.009:126): avc: denied { getattr } for pid=93 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 42.261337][ T1160] RAX: e223752fd92f8600 RBX: 0000000000000003 RCX: ffff8881156ba600 [ 42.261358][ T1160] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 42.342634][ T1160] RBP: ffffc9000414fc28 R08: ffffc9000414f907 R09: 1ffff92000829f20 [ 42.350916][ T1160] R10: dffffc0000000000 R11: fffff52000829f21 R12: 00000000ffffffea [ 42.358969][ T1160] R13: dffffc0000000000 R14: ffff88810979601c R15: 00000000c0000000 [ 42.367007][ T1160] FS: 00007f21635ca6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 42.376062][ T1160] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.382700][ T1160] CR2: 0000555569498928 CR3: 000000012e7c8000 CR4: 00000000003526b0 [ 42.391001][ T1160] Call Trace: [ 42.394289][ T1160] [ 42.397257][ T1160] config_item_put+0x230/0x240 [ 42.402052][ T1160] configfs_symlink+0x4b5/0x1050 [ 42.407034][ T1160] ? generic_permission+0x1ec/0x590 [ 42.412262][ T1160] ? __cfi_configfs_symlink+0x10/0x10 [ 42.417675][ T1160] ? selinux_inode_symlink+0x26/0x30 [ 42.422983][ T1160] ? bpf_lsm_inode_symlink+0xd/0x20 [ 42.428512][ T1160] ? security_inode_symlink+0x7e/0x170 [ 42.433984][ T1160] vfs_symlink+0x3f4/0x620 [ 42.438447][ T1160] do_symlinkat+0x1ba/0x400 [ 42.442969][ T1160] ? __cfi_do_symlinkat+0x10/0x10 [ 42.448041][ T1160] ? __kasan_check_write+0x18/0x20 [ 42.453220][ T1160] ? getname_flags+0x203/0x6b0 [ 42.458186][ T1160] ? __kasan_check_write+0x18/0x20 [ 42.463306][ T1160] __x64_sys_symlinkat+0x99/0xb0 [ 42.468486][ T1160] x64_sys_call+0x1f79/0x2ee0 [ 42.473178][ T1160] do_syscall_64+0x57/0xf0 [ 42.477778][ T1160] ? clear_bhb_loop+0x50/0xa0 [ 42.482498][ T1160] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 42.489320][ T1160] RIP: 0033:0x7f216279df99 [ 42.494228][ T1160] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.514697][ T1160] RSP: 002b:00007f21635ca028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 42.523354][ T1160] RAX: ffffffffffffffda RBX: 00007f2162a25fa0 RCX: 00007f216279df99 [ 42.531362][ T1160] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300 [ 42.539646][ T1160] RBP: 00007f2162834ec4 R08: 0000000000000000 R09: 0000000000000000 [ 42.547765][ T1160] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 42.556043][ T1160] R13: 00007f2162a26038 R14: 00007f2162a25fa0 R15: 00007ffc78c94af8 [ 42.564343][ T1160] [ 42.567417][ T1160] ---[ end trace 0000000000000000 ]--- 2026/08/16 23:00:09 executed programs: 348 2026/08/16 23:00:14 executed programs: 1395