Hi Kernel Maintainers, I hit the following KASAN report while testing current upstream kernel: KASAN: slab-use-after-free in cdev_put on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) The reproducer and .config files are here. https://gist.github.com/shuangpengbai/8f7dd0c0b1c638482b0e4cc62c554121 I’m happy to test debug patches or provide additional information. Reported-by: Shuangpeng Bai [ 133.746964][ T8494] ================================================================== [ 133.747541][ T8494] BUG: KASAN: slab-use-after-free in cdev_put (fs/char_dev.c:361) [ 133.748018][ T8494] Read of size 8 at addr ffff8881066d7108 by task bad_nvme_io/8494 [ 133.748544][ T8494] [ 133.748716][ T8494] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.34 [ 133.748718][ T8494] Call Trace: [ 133.748720][ T8494] [ 133.748721][ T8494] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) [ 133.748725][ T8494] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) [ 133.748734][ T8494] kasan_report (mm/kasan/report.c:595) [ 133.748738][ T8494] cdev_put (fs/char_dev.c:361) [ 133.748740][ T8494] __fput (fs/file_table.c:513) [ 133.748743][ T8494] fput_close_sync (fs/file_table.c:615) [ 133.748756][ T8494] __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492) [ 133.748759][ T8494] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 133.748761][ T8494] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 133.748764][ T8494] RIP: 0033:0x7fd3713a311b [ 133.748767][ T8494] Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 f3 fb ff f4 Code starting with the faulting instruction =========================================== 0: 0f 05 syscall 2: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 8: 77 45 ja 0x4f a: c3 ret b: 0f 1f 40 00 nopl 0x0(%rax) f: 48 83 ec 18 sub $0x18,%rsp 13: 89 7c 24 0c mov %edi,0xc(%rsp) 17: e8 f3 fb ff f4 call 0xfffffffff4fffc0f [ 133.748769][ T8494] RSP: 002b:00007fd3709b7e60 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 133.748773][ T8494] RAX: ffffffffffffffda RBX: 0000557a0cdd5390 RCX: 00007fd3713a311b [ 133.748775][ T8494] RDX: 00007fd3709b7e80 RSI: 00000000c0484e43 RDI: 0000000000000010 [ 133.748776][ T8494] RBP: 0000000000000010 R08: 0000000000000000 R09: 00007fd3709b8700 [ 133.748778][ T8494] R10: 0000000000000000 R11: 0000000000000293 R12: 00007fd3709b7e80 [ 133.748779][ T8494] R13: 000000000000010b R14: 00007fd3709b7fc0 R15: 0000000000802000 [ 133.748782][ T8494] [ 133.748783][ T8494] [ 133.760567][ T8494] Freed by task 8494 on cpu 1 at 133.746963s: [ 133.760976][ T8494] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) [ 133.761296][ T8494] kasan_save_free_info (mm/kasan/generic.c:584) [ 133.761651][ T8494] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) [ 133.761976][ T8494] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) [ 133.762243][ T8494] nvme_ns_head_chr_release (drivers/nvme/host/multipath.c:606) [ 133.762617][ T8494] __fput (fs/file_table.c:510) [ 133.762889][ T8494] fput_close_sync (fs/file_table.c:615) [ 133.763213][ T8494] __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492) [ 133.763526][ T8494] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 133.763838][ T8494] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 133.764235][ T8494] [ 133.764398][ T8494] The buggy address belongs to the object at ffff8881066d7000 [ 133.764398][ T8494] which belongs to the cache kmalloc-2k of size 2048 [ 133.765325][ T8494] The buggy address is located 264 bytes inside of [ 133.765325][ T8494] freed 2048-byte region [ffff8881066d7000, ffff8881066d7800) Best, Shuangpeng