Re: [BUG] KASAN: slab-use-after-free Read in __timer_delete

[Greg KH]

On Mon, Aug 24, 2026 at 11:53:13PM +0900, Jaeyoung Chung wrote:
> Hello,
> 
> We found a "KASAN: slab-use-after-free Read in __timer_delete" on Linux v7.2.
> The issue was found by our own race fuzzer. We have not analyzed the root cause,
> so we do not have a proposed fix to offer.
> 
> To reproduce the race reliably, we applied the delay patch below to the
> kernel and ran the C reproducer as root inside an x86_64 QEMU guest. The
> crash log we observed, the delay patch and the reproducer are all included
> below.
> 
> The following kernel config options are required to reproduce the issue:
>     CONFIG_N_GSM=y
>     CONFIG_TTY=y
>     CONFIG_KASAN=y
> 
> We hope this report is useful. Please let us know if any further
> information would help.

Please see the email archives for why attempting to fuzz this file is
not going to go well, and why you should just ignore it UNLESS you have
this hardware.

thanks,

greg k-h