===================================================== BUG: KMSAN: use-after-free in n_tty_receive_char_special drivers/tty/n_tty.c:1347 [inline] BUG: KMSAN: use-after-free in n_tty_receive_buf_standard+0x1283/0x98a0 drivers/tty/n_tty.c:1588 n_tty_receive_char_special drivers/tty/n_tty.c:1347 [inline] n_tty_receive_buf_standard+0x1283/0x98a0 drivers/tty/n_tty.c:1588 __receive_buf drivers/tty/n_tty.c:1624 [inline] n_tty_receive_buf_common+0x198b/0x2470 drivers/tty/n_tty.c:1723 n_tty_receive_buf2+0x4c/0x60 drivers/tty/n_tty.c:1769 tty_ldisc_receive_buf+0xc3/0x2c0 drivers/tty/tty_buffer.c:388 tty_port_default_receive_buf+0xd7/0x1a0 drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:446 [inline] flush_to_ldisc+0x43e/0xe30 drivers/tty/tty_buffer.c:496 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa2d/0x1b80 kernel/workqueue.c:3319 worker_thread+0xedf/0x1590 kernel/workqueue.c:3400 kthread+0xd5c/0xf00 kernel/kthread.c:463 ret_from_fork+0x230/0x380 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Uninit was created at: slab_free_hook mm/slub.c:2348 [inline] slab_free mm/slub.c:4695 [inline] kfree+0x252/0xec0 mm/slub.c:4894 ieee80211_ibss_rx_queued_mgmt+0x2eea/0x3e80 net/mac80211/ibss.c:-1 ieee80211_iface_process_skb net/mac80211/iface.c:1699 [inline] ieee80211_iface_work+0x11c7/0x1e70 net/mac80211/iface.c:1753 cfg80211_wiphy_work+0x341/0x850 net/wireless/core.c:435 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa2d/0x1b80 kernel/workqueue.c:3319 worker_thread+0xedf/0x1590 kernel/workqueue.c:3400 kthread+0xd5c/0xf00 kernel/kthread.c:463 ret_from_fork+0x230/0x380 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 CPU: 0 UID: 0 PID: 3884 Comm: kworker/u8:21 Not tainted syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: events_unbound flush_to_ldisc =====================================================