Groups
Groups
Sign in
Groups
Groups
syzkaller-bugs
Conversations
About
Send feedback
Help
Sort By Relevance
Sort By Date
1–30 of many
syzbot
, …
Hillf Danton
27
Mar 13
[syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
slab-
use
-
after
-
free
Read in sock_def_readable ================================================================== BUG: KASAN: slab-
use
-
after
-
free
in list_empty include
unread,
[syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
slab-
use
-
after
-
free
Read in sock_def_readable ================================================================== BUG: KASAN: slab-
use
-
after
-
free
in list_empty include
Mar 13
syzbot
Mar 5
[syzbot] [rds?] KASAN: slab-use-after-free Read in rds_conn_path_drop
slab-
use
-
after
-
free
in instrument_atomic_read include/linux/instrumented.h:82 [inline] BUG: KASAN: slab-
use
-
after
-
free
in atomic_read include/linux/atomic/atomic
unread,
[syzbot] [rds?] KASAN: slab-use-after-free Read in rds_conn_path_drop
slab-
use
-
after
-
free
in instrument_atomic_read include/linux/instrumented.h:82 [inline] BUG: KASAN: slab-
use
-
after
-
free
in atomic_read include/linux/atomic/atomic
Mar 5
syzbot
Mar 3
[syzbot] [wireless?] WARNING: refcount bug in rsi_91x_deinit
0;
use
-
after
-
free
. WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x111/0x130 lib/refcount.c:25, CPU#0: kworker/0:1/10 Modules linked in: CPU: 0 UID: 0 PID: 10 Comm
unread,
[syzbot] [wireless?] WARNING: refcount bug in rsi_91x_deinit
0;
use
-
after
-
free
. WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x111/0x130 lib/refcount.c:25, CPU#0: kworker/0:1/10 Modules linked in: CPU: 0 UID: 0 PID: 10 Comm
Mar 3
syzbot
,
Qing Wang
4
Mar 3
[syzbot] [bpf?] [trace?] KASAN: slab-use-after-free Read in bpf_trace_run9
slab-
use
-
after
-
free
in __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline] BUG: KASAN: slab-
use
-
after
-
free
in bpf_trace_run9+0x13b/0x8c0 kernel/trace/bpf_trace
unread,
[syzbot] [bpf?] [trace?] KASAN: slab-use-after-free Read in bpf_trace_run9
slab-
use
-
after
-
free
in __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline] BUG: KASAN: slab-
use
-
after
-
free
in bpf_trace_run9+0x13b/0x8c0 kernel/trace/bpf_trace
Mar 3
syzbot
, …
Jan Kara
23
Mar 6
[syzbot] [ext4?] INFO: task hung in filename_unlinkat
slab-
use
-
after
-
free
Read in ext4_xattr_block_csum_set * KASAN: slab-
use
-
after
-
free
Read in ext4_xattr_set_entry * KASAN:
use
-
after
-
free
Read in ext4_xattr_block_csum_set
unread,
[syzbot] [ext4?] INFO: task hung in filename_unlinkat
slab-
use
-
after
-
free
Read in ext4_xattr_block_csum_set * KASAN: slab-
use
-
after
-
free
Read in ext4_xattr_set_entry * KASAN:
use
-
after
-
free
Read in ext4_xattr_block_csum_set
Mar 6
syzbot
,
Qing Wang
9
Mar 4
[syzbot] [bpf?] [trace?] KASAN: slab-use-after-free Read in bpf_trace_run3 (2)
slab-
use
-
after
-
free
in __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline] BUG: KASAN: slab-
use
-
after
-
free
in bpf_trace_run3+0xdd/0x850 kernel/trace/bpf_trace
unread,
[syzbot] [bpf?] [trace?] KASAN: slab-use-after-free Read in bpf_trace_run3 (2)
slab-
use
-
after
-
free
in __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline] BUG: KASAN: slab-
use
-
after
-
free
in bpf_trace_run3+0xdd/0x850 kernel/trace/bpf_trace
Mar 4
syzbot ci
, …
syzbot ci
8
Feb 26
[syzbot ci] Re: Close race in freeing special fields and map value
slab-
use
-
after
-
free
Read in free_all > > Full report is available here: > https://ci.syzbot.org/series/ad9c7ce6-d861-4afe-821a-e8fae6120b12 > > *** >
unread,
[syzbot ci] Re: Close race in freeing special fields and map value
slab-
use
-
after
-
free
Read in free_all > > Full report is available here: > https://ci.syzbot.org/series/ad9c7ce6-d861-4afe-821a-e8fae6120b12 > > *** >
Feb 26
syzbot
,
Gao Xiang
3
Feb 24
[syzbot] [erofs?] KASAN: use-after-free Read in z_erofs_transform_plain (2)
:1422
process_one_work
kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue
unread,
[syzbot] [erofs?] KASAN: use-after-free Read in z_erofs_transform_plain (2)
:1422
process_one_work
kernel/workqueue.c:3275 [inline] process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358 worker_thread+0xa50/0xfc0 kernel/workqueue
Feb 24
syzbot
13
Feb 21
[syzbot] [trace?] [bpf?] KASAN: slab-use-after-free Read in bpf_trace_run2 (3)
slab-
use
-
after
-
free
in __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline] BUG: KASAN: slab-
use
-
after
-
free
in bpf_trace_run2+0xb1/0x840 kernel/trace/bpf_trace
unread,
[syzbot] [trace?] [bpf?] KASAN: slab-use-after-free Read in bpf_trace_run2 (3)
slab-
use
-
after
-
free
in __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline] BUG: KASAN: slab-
use
-
after
-
free
in bpf_trace_run2+0xb1/0x840 kernel/trace/bpf_trace
Feb 21
Sam Sun
, …
syzbot
5
Feb 14
[Linux xfs bug] KASAN: slab-use-after-free Read in fserror_worker
slab-
use
-
after
-
free
in inode_state_read_once include/linux/fs.h:884 [inline] BUG: KASAN: slab-
use
-
after
-
free
in iput+0x3a7/0xe80 fs/inode.c:1977 Read of size 4 at addr
unread,
[Linux xfs bug] KASAN: slab-use-after-free Read in fserror_worker
slab-
use
-
after
-
free
in inode_state_read_once include/linux/fs.h:884 [inline] BUG: KASAN: slab-
use
-
after
-
free
in iput+0x3a7/0xe80 fs/inode.c:1977 Read of size 4 at addr
Feb 14
syzbot
, …
Hillf Danton
12
Feb 11
[syzbot] [kernel?] KASAN: slab-use-after-free Read in futex_unqueue
slab-
use
-
after
-
free
in __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] BUG: KASAN: slab-
use
-
after
-
free
in _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock
unread,
[syzbot] [kernel?] KASAN: slab-use-after-free Read in futex_unqueue
slab-
use
-
after
-
free
in __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] BUG: KASAN: slab-
use
-
after
-
free
in _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock
Feb 11
syzbot
,
Thomas Gleixner
4
Feb 10
[syzbot] [kernel?] KMSAN: uninit-value in __schedule (5)
slab-
use
-
after
-
free
in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-
use
-
after
-
free
in atomic_read include/linux/atomic/atomic
unread,
[syzbot] [kernel?] KMSAN: uninit-value in __schedule (5)
slab-
use
-
after
-
free
in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-
use
-
after
-
free
in atomic_read include/linux/atomic/atomic
Feb 10
Sam Sun
Feb 2
[Linux kernel bug] general protection fault in wg_packet_send_queued_handshake_initiation
:51
process_one_work
+0x9cd/0x1ba0 kernel/workqueue.c:3304 process_scheduled_works kernel/workqueue.c:3401 [inline] worker_thread+0x67e/0xe90 kernel/workqueue.
unread,
[Linux kernel bug] general protection fault in wg_packet_send_queued_handshake_initiation
:51
process_one_work
+0x9cd/0x1ba0 kernel/workqueue.c:3304 process_scheduled_works kernel/workqueue.c:3401 [inline] worker_thread+0x67e/0xe90 kernel/workqueue.
Feb 2
syzbot
,
Florian Westphal
7
Jan 28
[syzbot] [netfilter?] KASAN: slab-use-after-free Read in nft_array_get_cmp
slab-
use
-
after
-
free
Read in nft_array_get_cmp ================================================================== BUG: KASAN: slab-
use
-
after
-
free
in nft_set_ext include
unread,
[syzbot] [netfilter?] KASAN: slab-use-after-free Read in nft_array_get_cmp
slab-
use
-
after
-
free
Read in nft_array_get_cmp ================================================================== BUG: KASAN: slab-
use
-
after
-
free
in nft_set_ext include
Jan 28
syzbot
,
Hillf Danton
3
Feb 3
[syzbot] [sound?] KASAN: slab-use-after-free Read in snd_pcm_stop
slab-
use
-
after
-
free
in rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56 Read of size 1 at addr ffff88803c59a200 by task syz.0.88/6375 CPU: 1 UID: 0 PID: 6375 Comm: syz
unread,
[syzbot] [sound?] KASAN: slab-use-after-free Read in snd_pcm_stop
slab-
use
-
after
-
free
in rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56 Read of size 1 at addr ffff88803c59a200 by task syz.0.88/6375 CPU: 1 UID: 0 PID: 6375 Comm: syz
Feb 3
syzbot ci
Jan 26
[syzbot ci] Re: nfc: nci: Fix race between rfkill and nci_unregister_device().
slab-
use
-
after
-
free
Read in nci_unregister_device Full report is available here: https://ci.syzbot.org/series/1b1f8783-f1b1-4eaf-8140-aeb610bb4b90 *** KASAN: slab-
unread,
[syzbot ci] Re: nfc: nci: Fix race between rfkill and nci_unregister_device().
slab-
use
-
after
-
free
Read in nci_unregister_device Full report is available here: https://ci.syzbot.org/series/1b1f8783-f1b1-4eaf-8140-aeb610bb4b90 *** KASAN: slab-
Jan 26
syzbot
,
Hillf Danton
9
Jan 23
[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_sock_ready_cb (2)
:1670
process_one_work
+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue
unread,
[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_sock_ready_cb (2)
:1670
process_one_work
+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue
Jan 23
syzbot
Jan 22
[syzbot] [media?] KASAN: slab-use-after-free Read in em28xx_unregister_media_device
slab-
use
-
after
-
free
in media_device_unregister drivers/media/mc/mc-device.c:804 [inline] BUG: KASAN: slab-
use
-
after
-
free
in media_device_unregister+0x565/0x5e0 drivers
unread,
[syzbot] [media?] KASAN: slab-use-after-free Read in em28xx_unregister_media_device
slab-
use
-
after
-
free
in media_device_unregister drivers/media/mc/mc-device.c:804 [inline] BUG: KASAN: slab-
use
-
after
-
free
in media_device_unregister+0x565/0x5e0 drivers
Jan 22
syzbot
Jan 21
[syzbot] [fs?] KASAN: slab-use-after-free Read in proc_invalidate_siblings_dcache (2)
slab-
use
-
after
-
free
in proc_invalidate_siblings_dcache+0x6ae/0x6bc fs/proc/inode.c:114 Read of size 8 at addr ffffaf801aba9a18 by task sshd/3175 CPU: 0 UID: 0 PID: 3175 Comm
unread,
[syzbot] [fs?] KASAN: slab-use-after-free Read in proc_invalidate_siblings_dcache (2)
slab-
use
-
after
-
free
in proc_invalidate_siblings_dcache+0x6ae/0x6bc fs/proc/inode.c:114 Read of size 8 at addr ffffaf801aba9a18 by task sshd/3175 CPU: 0 UID: 0 PID: 3175 Comm
Jan 21
syzbot
Jan 20
[syzbot] [usb?] KASAN: slab-use-after-free Read in event_handler
slab-
use
-
after
-
free
in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] BUG: KASAN: slab-
use
-
after
-
free
in _raw_spin_lock_irqsave+0x40/0x60
unread,
[syzbot] [usb?] KASAN: slab-use-after-free Read in event_handler
slab-
use
-
after
-
free
in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] BUG: KASAN: slab-
use
-
after
-
free
in _raw_spin_lock_irqsave+0x40/0x60
Jan 20
syzbot
, …
syzbot
16
Jan 19
[syzbot] Monthly xfs report (Oct 2025)
:47
process_one_work
+0x7c0/0x1558 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x958/0xed8 kernel/workqueue.
unread,
[syzbot] Monthly xfs report (Oct 2025)
:47
process_one_work
+0x7c0/0x1558 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x958/0xed8 kernel/workqueue.
Jan 19
syzbot
,
Jeongjun Park
3
Jan 17
[syzbot] [hams?] BUG: unable to handle kernel paging request in sk_skb_reason_drop
slab-
use
-
after
-
free
in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-
use
-
after
-
free
in atomic_fetch_sub_release include/
unread,
[syzbot] [hams?] BUG: unable to handle kernel paging request in sk_skb_reason_drop
slab-
use
-
after
-
free
in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-
use
-
after
-
free
in atomic_fetch_sub_release include/
Jan 17
syzbot
Jan 12
[syzbot] [net?] KASAN: slab-use-after-free Read in inet6_addr_del (2)
slab-
use
-
after
-
free
in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 Read of size 4 at addr ffff88807b89c86c by task syz.3.1618/9593 CPU: 0 UID: 0 PID:
unread,
[syzbot] [net?] KASAN: slab-use-after-free Read in inet6_addr_del (2)
slab-
use
-
after
-
free
in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 Read of size 4 at addr ffff88807b89c86c by task syz.3.1618/9593 CPU: 0 UID: 0 PID:
Jan 12
syzbot
Jan 12
[syzbot] [net?] KASAN: slab-use-after-free Write in rt6_disable_ip
slab-
use
-
after
-
free
in INIT_LIST_HEAD include/linux/list.h:46 [inline] BUG: KASAN: slab-
use
-
after
-
free
in list_del_init include/linux/list.h:296 [inline] BUG: KASAN
unread,
[syzbot] [net?] KASAN: slab-use-after-free Write in rt6_disable_ip
slab-
use
-
after
-
free
in INIT_LIST_HEAD include/linux/list.h:46 [inline] BUG: KASAN: slab-
use
-
after
-
free
in list_del_init include/linux/list.h:296 [inline] BUG: KASAN
Jan 12
syzbot
, …
Hans Verkuil
15
Mar 16
[syzbot] [media?] KASAN: slab-use-after-free Read in em28xx_release_resources
slab-
use
-
after
-
free
Read in v4l2_open ================================================================== BUG: KASAN: slab-
use
-
after
-
free
in v4l2_open+0x395/0x3a0
unread,
[syzbot] [media?] KASAN: slab-use-after-free Read in em28xx_release_resources
slab-
use
-
after
-
free
Read in v4l2_open ================================================================== BUG: KASAN: slab-
use
-
after
-
free
in v4l2_open+0x395/0x3a0
Mar 16
syzbot
Jan 8
[syzbot] [net?] KASAN: slab-use-after-free Read in macvlan_forward_source
slab-
use
-
after
-
free
in macvlan_forward_source+0x512/0x630 drivers/net/macvlan.c:436 Read of size 2 at addr ffff888030edadfc by task ksoftirqd/0/15 CPU: 0 UID: 0 PID: 15 Comm
unread,
[syzbot] [net?] KASAN: slab-use-after-free Read in macvlan_forward_source
slab-
use
-
after
-
free
in macvlan_forward_source+0x512/0x630 drivers/net/macvlan.c:436 Read of size 2 at addr ffff888030edadfc by task ksoftirqd/0/15 CPU: 0 UID: 0 PID: 15 Comm
Jan 8
syzbot
,
Chao Yu
11
Jan 7
[syzbot] [f2fs?] KASAN: use-after-free Read in f2fs_write_end_io (2)
slab-
use
-
after
-
free
in instrument_atomic_read include/linux/instrumented.h:68 [inline] > BUG: KASAN: slab-
use
-
after
-
free
in atomic_read include/linux/atomic/atomic
unread,
[syzbot] [f2fs?] KASAN: use-after-free Read in f2fs_write_end_io (2)
slab-
use
-
after
-
free
in instrument_atomic_read include/linux/instrumented.h:68 [inline] > BUG: KASAN: slab-
use
-
after
-
free
in atomic_read include/linux/atomic/atomic
Jan 7
syzbot
12/23/25
[syzbot] [pm?] KASAN: slab-use-after-free Read in thermal_zone_device_check
slab-
use
-
after
-
free
in __mutex_lock_common kernel/locking/mutex.c:593 [inline] BUG: KASAN: slab-
use
-
after
-
free
in __mutex_lock+0x147/0x1350 kernel/locking/mutex.
unread,
[syzbot] [pm?] KASAN: slab-use-after-free Read in thermal_zone_device_check
slab-
use
-
after
-
free
in __mutex_lock_common kernel/locking/mutex.c:593 [inline] BUG: KASAN: slab-
use
-
after
-
free
in __mutex_lock+0x147/0x1350 kernel/locking/mutex.
12/23/25
syzbot
12/21/25
[syzbot] [usb?] KASAN: slab-use-after-free Read in vhci_tx_loop
slab-
use
-
after
-
free
in vhci_send_cmd_submit drivers/usb/usbip/vhci_tx.c:69 [inline] BUG: KASAN: slab-
use
-
after
-
free
in vhci_tx_loop+0x38e/0x1a80 drivers/usb/usbip
unread,
[syzbot] [usb?] KASAN: slab-use-after-free Read in vhci_tx_loop
slab-
use
-
after
-
free
in vhci_send_cmd_submit drivers/usb/usbip/vhci_tx.c:69 [inline] BUG: KASAN: slab-
use
-
after
-
free
in vhci_tx_loop+0x38e/0x1a80 drivers/usb/usbip
12/21/25
syzbot
2
12/18/25
[syzbot] [io-uring?] KASAN: slab-use-after-free Read in io_poll_remove_entries (2)
slab-
use
-
after
-
free
Read in io_poll_remove_entries (2) Author: axboe@kernel.dk #syz invalid On Fri, Nov 28, 2025 at 2:02 AM syzbot wrote: > > Hello, > > syzbot found
unread,
[syzbot] [io-uring?] KASAN: slab-use-after-free Read in io_poll_remove_entries (2)
slab-
use
-
after
-
free
Read in io_poll_remove_entries (2) Author: axboe@kernel.dk #syz invalid On Fri, Nov 28, 2025 at 2:02 AM syzbot wrote: > > Hello, > > syzbot found
12/18/25