# Redacted crash(8) analysis — (Dell PowerEdge R750xa), kdump of 2026-06-21. # Source: crash(8) over vmcore + vmlinux debuginfo for 5.14.0-687.15.1.el9_8. # Anonymized: , , , , , , # . Nothing else altered. (The crash dump itself carries the real # NODENAME etc.; this excerpt is the redacted copy for the public bug tracker.) # Effective mount uses cache=strict (see expanded options below); the cifs stack # accordingly shows cifs_strict_writev, absent on the cache=none host. given options via autofs: sec=krb5,cruid=${UID},uid=${UID},gid=${GID},forceuid,forcegid,iocharset=utf8,vers=3.0,nosuid,nodev,dir_mode=0700,file_mode=0700,noserverino,cache=none after option expanding: (rw,nosuid,nodev,relatime,vers=3.0,sec=krb5,cruid=,cache=strict,upcall_target=app,username=,uid=,forceuid,gid=,forcegid,addr=,file_mode=0700,dir_mode=0700,iocharset=utf8,soft,nounix,mapposix,reparse=nfs,nativesocket,symlink=native,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1) KERNEL: /usr/lib/debug/lib/modules/5.14.0-687.15.1.el9_8.x86_64/vmlinux [TAINTED] DUMPFILE: vmcore [PARTIAL DUMP] CPUS: 24 DATE: Sun Jun 21 15:37:55 CEST 2026 UPTIME: 1 days, 02:05:34 LOAD AVERAGE: 14.80, 15.63, 14.23 TASKS: 2508 NODENAME: RELEASE: 5.14.0-687.15.1.el9_8.x86_64 VERSION: #1 SMP PREEMPT_DYNAMIC Thu Jun 11 08:51:45 EDT 2026 MACHINE: x86_64 (3000 Mhz) MEMORY: 383.2 GB PANIC: "kernel BUG at mm/filemap.c:1593!" PID: 246362 COMMAND: "pt_main_thread" TASK: ff1f8fe808712340 [THREAD_INFO: ff1f8fe808712340] CPU: 21 STATE: TASK_RUNNING (PANIC) 1567 /** 1568 * folio_end_writeback - End writeback against a folio. 1569 * @folio: The folio. 1570 */ 1571 void folio_end_writeback(struct folio *folio) 1572 { 0xffffffff813791a0 <+0>: call 0xffffffff8107d860 <__fentry__> 0xffffffff813791a9 <+9>: mov %rdi,%rbp 1573 /* 1574 * folio_test_clear_reclaim() could be used here but it is an 1575 * atomic operation and overkill in this particular case. Failing 1576 * to shuffle a folio marked for immediate reclaim is too mild 1577 * a gain to justify taking an atomic operation penalty at the 1578 * end of every folio writeback. 1579 */ 1580 if (folio_test_reclaim(folio)) { 0xffffffff813791ac <+12>: test $0x40000,%eax 0xffffffff813791b1 <+17>: jne 0xffffffff813791fe 1581 folio_clear_reclaim(folio); 1582 folio_rotate_reclaimable(folio); 0xffffffff81379203 <+99>: call 0xffffffff8138c5f0 0xffffffff81379208 <+104>: jmp 0xffffffff813791b3 1583 } 1584 1585 /* 1586 * Writeback does not hold a folio reference of its own, relying 1587 * on truncation to wait for the clearing of PG_writeback. 1588 * But here we must make sure that the folio is not freed and 1589 * reused before the folio_wake(). 1590 */ 1591 folio_get(folio); 1592 if (!__folio_end_writeback(folio)) 0xffffffff813791b7 <+23>: mov %rbp,%rdi 0xffffffff813791ba <+26>: call 0xffffffff813881d0 <__folio_end_writeback> 0xffffffff813791bf <+31>: test %al,%al 0xffffffff813791c1 <+33>: je 0xffffffff8137921d 1593 BUG(); 0xffffffff8137921d <+125>: ud2 1594 1595 smp_mb__after_atomic(); 1596 folio_wake(folio, PG_writeback); 1597 acct_reclaim_writeback(folio); 1598 folio_put(folio); 1599 } 0xffffffff813791f8 <+88>: pop %rbp 0xffffffff813791f9 <+89>: jmp 0xffffffff81d65cb0 <__x86_return_thunk> 0xffffffff8137920d <+109>: pop %rbp PID: 246362 TASK: ff1f8fe808712340 CPU: 21 COMMAND: "pt_main_thread" #0 [ff77d49b26d3f9b0] machine_kexec at ffffffff9cc7f00e #1 [ff77d49b26d3fa08] __crash_kexec at ffffffff9ce25d8a #2 [ff77d49b26d3fac8] crash_kexec at ffffffff9ce26370 #3 [ff77d49b26d3fad0] oops_end at ffffffff9cc38fd6 #4 [ff77d49b26d3faf0] do_trap at ffffffff9cc34d8f #5 [ff77d49b26d3fb40] do_error_trap at ffffffff9cc34e35 #6 [ff77d49b26d3fb80] exc_invalid_op at ffffffff9d94d77e #7 [ff77d49b26d3fba0] asm_exc_invalid_op at ffffffff9da00b36 [exception RIP: folio_end_writeback+125] RIP: ffffffff9cf7921d RSP: ff77d49b26d3fc58 RFLAGS: 00010246 RAX: 0000000000000400 RBX: ff1f8fe082bafe00 RCX: 0000000000204008 RDX: 0000000000000001 RSI: 0000000000000206 RDI: ff1f8fe808712340 RBP: ffb7255315772740 R8: 0000000000000206 R9: ff77d49b26d3f9c0 R10: 0000000000000007 R11: ff1f8fe082bafe00 R12: 0000000000000470 R13: 0000000000000000 R14: ff77d49b26d3fde0 R15: ff1f8fb10802db00 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #8 [ff77d49b26d3fc60] cifs_writepages at ffffffffc84f75e8 [cifs] #9 [ff77d49b26d3fd28] do_writepages at ffffffff9cf87cd5 #10 [ff77d49b26d3fdb8] filemap_fdatawrite_wbc at ffffffff9cf774a6 #11 [ff77d49b26d3fdd8] __filemap_fdatawrite_range at ffffffff9cf7c194 #12 [ff77d49b26d3fe50] filemap_write_and_wait_range at ffffffff9cf7c3ee #13 [ff77d49b26d3fe78] cifs_flush at ffffffffc84f9293 [cifs] #14 [ff77d49b26d3fe98] filp_flush at ffffffff9d088ace #15 [ff77d49b26d3feb8] __x64_sys_close at ffffffff9d088b9e #16 [ff77d49b26d3fed0] do_syscall_64 at ffffffff9d94cf8f #17 [ff77d49b26d3ff50] entry_SYSCALL_64_after_hwframe at ffffffff9da0012b RIP: 00007f3e93903f3b RSP: 00007f3e5baff178 RFLAGS: 00000202 RAX: ffffffffffffffda RBX: 00007f3d99ab1470 RCX: 00007f3e93903f3b RDX: 00007f3e939f79e0 RSI: 00000000fbad2404 RDI: 000000000000003e RBP: 0000000000000000 R8: 0000000000000000 R9: 0000000000000000 R10: 0000000000000200 R11: 0000000000000202 R12: 00007f3e939f85e0 R13: 00007f3e55ba4d20 R14: 00007f3e5baff300 R15: 00007f3d69e0a790 ORIG_RAX: 0000000000000003 CS: 0033 SS: 002b crash> kmem ff1f8fe808712340 CACHE OBJSIZE ALLOCATED TOTAL SLABS SSIZE NAME ff1f8fb100202300 8968 2508 2679 893 32k task_struct SLAB MEMORY NODE TOTAL ALLOCATED FREE ffb725532021c400 ff1f8fe808710000 1 3 3 0 FREE / [ALLOCATED] [ff1f8fe808712340] PID: 246362 COMMAND: "pt_main_thread" TASK: ff1f8fe808712340 [THREAD_INFO: ff1f8fe808712340] CPU: 21 STATE: TASK_RUNNING (PANIC) PAGE PHYSICAL MAPPING INDEX CNT FLAGS ffb725532021c480 3808712000 dead000000000400 0 0 57ffffc0000000 [93933.660360] CIFS: VFS: \\ Error -32 sending data on socket to server [93933.660799] ------------[ cut here ]------------ [93933.660803] refcount_t: underflow; use-after-free. [93933.660837] WARNING: CPU: 21 PID: 246362 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [93933.660878] Modules linked in: binfmt_misc nls_utf8 cifs cifs_arc4 rdma_cm iw_cm ib_cm ib_core cifs_md4 dns_resolver nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink qrtr vfat fat nvidia_uvm(POE) nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common i10nm_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm dell_wmi rapl ledtrig_audio intel_cstate sparse_keymap rfkill iTCO_wdt iTCO_vendor_support dcdbas ipmi_ssif dell_smbios wmi_bmof dell_wmi_descriptor drm_ttm_helper isst_if_mmio isst_if_mbox_pci intel_uncore ttm mei_me pcspkr video isst_if_common intel_th_gth mei i2c_i801 acpi_power_meter intel_th_pci intel_pch_thermal i2c_smbus ipmi_si intel_vsec intel_th acpi_ipmi ipmi_devintf ipmi_msghandler auth_rpcgss sunrpc xfs libcrc32c sd_mod sg mgag200 drm_client_lib [93933.661028] i2c_algo_bit drm_shmem_helper drm_kms_helper ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel drm i40e libata megaraid_sas ghash_clmulni_intel tg3 libie libie_adminq wmi dm_mirror dm_region_hash dm_log dm_mod i2c_dev fuse [93933.661071] CPU: 21 PID: 246362 Comm: pt_main_thread Kdump: loaded Tainted: P OE ------ --- 5.14.0-687.15.1.el9_8.x86_64 #1 [93933.661079] Hardware name: Dell Inc. PowerEdge R750xa/, BIOS 1.20.2 01/16/2026 [93933.661084] RIP: 0010:refcount_warn_saturate+0xba/0x110 [93933.661092] Code: 01 01 e8 69 b1 a5 ff 0f 0b c3 cc cc cc cc 80 3d 74 61 c9 01 00 75 85 48 c7 c7 a8 4c 31 9e c6 05 64 61 c9 01 01 e8 46 b1 a5 ff <0f> 0b e9 0f b0 6a 00 80 3d 4f 61 c9 01 00 0f 85 5e ff ff ff 48 c7 [93933.661098] RSP: 0018:ff77d49b26d3fb18 EFLAGS: 00010282 [93933.661104] RAX: 0000000000000000 RBX: ff1f8fe70675eb40 RCX: 0000000000000027 [93933.661109] RDX: 0000000000000027 RSI: 00000000ffff7fff RDI: ff1f900fafaa0f08 [93933.661113] RBP: ff1f8fe078f841c0 R08: 0000000000000000 R09: ff77d49b26d3f9c0 [93933.661116] R10: ff77d49b26d3f9b8 R11: ffffffff9ede2ee8 R12: ff1f8fe078f84000 [93933.661120] R13: ff1f8fe193a26cc0 R14: 00000000ffffff99 R15: ff1f8fe078f841f8 [93933.661123] FS: 00007f3e5bb01640(0000) GS:ff1f900fafa80000(0000) knlGS:0000000000000000 [93933.661128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [93933.661132] CR2: 00002ac406c22400 CR3: 0000003089dac006 CR4: 0000000000773ef0 [93933.661135] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [93933.661138] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [93933.661141] PKRU: 55555554 [93933.661143] Call Trace: [93933.661149] [93933.661159] ? __warn+0x84/0x140 [93933.661171] ? refcount_warn_saturate+0xba/0x110 [93933.661179] ? report_bug+0x16b/0x180 [93933.661191] ? handle_bug+0x3c/0x70 [93933.661207] ? exc_invalid_op+0x14/0x70 [93933.661216] ? asm_exc_invalid_op+0x16/0x20 [93933.661232] ? refcount_warn_saturate+0xba/0x110 [93933.661237] ? refcount_warn_saturate+0xba/0x110 [93933.661245] cifs_call_async+0x1ee/0x330 [cifs] [93933.661498] smb2_async_writev+0x473/0x6f0 [cifs] [93933.661730] ? __pfx_cifs_writedata_release+0x10/0x10 [cifs] [93933.661948] ? cifs_writepages+0x52f/0xbc0 [cifs] [93933.662144] cifs_writepages+0x52f/0xbc0 [cifs] [93933.662323] ? generic_perform_write+0x14c/0x210 [93933.662334] do_writepages+0xd5/0x1b0 [93933.662348] ? cifs_strict_writev+0x1c4/0x330 [cifs] [93933.662538] filemap_fdatawrite_wbc+0x66/0x90 [93933.662545] __filemap_fdatawrite_range+0x54/0x80 [93933.662554] filemap_write_and_wait_range+0x3e/0xb0 [93933.662563] cifs_flush+0x73/0x120 [cifs] [93933.662751] filp_flush+0x2e/0x80 [93933.662761] __x64_sys_close+0x2e/0x80 [93933.662766] do_syscall_64+0x5f/0xe0 [93933.662776] ? do_user_addr_fault+0x35d/0x6a0 [93933.662785] ? clear_bhb_loop+0x40/0x90 [93933.662790] ? clear_bhb_loop+0x40/0x90 [93933.662794] ? clear_bhb_loop+0x40/0x90 [93933.662798] ? clear_bhb_loop+0x40/0x90 [93933.662801] ? clear_bhb_loop+0x40/0x90 [93933.662805] entry_SYSCALL_64_after_hwframe+0x76/0x7e [93933.662816] RIP: 0033:0x7f3e93903f3b [93933.662824] Code: c3 66 0f 1f 44 00 00 48 8b 15 d9 6e 0f 00 f7 d8 64 89 02 b8 ff ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 a9 6e 0f 00 f7 d8 [93933.662829] RSP: 002b:00007f3e5baff178 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [93933.662835] RAX: ffffffffffffffda RBX: 00007f3d99ab1470 RCX: 00007f3e93903f3b [93933.662838] RDX: 00007f3e939f79e0 RSI: 00000000fbad2404 RDI: 000000000000003e [93933.662841] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [93933.662844] R10: 0000000000000200 R11: 0000000000000202 R12: 00007f3e939f85e0 [93933.662847] R13: 00007f3e55ba4d20 R14: 00007f3e5baff300 R15: 00007f3d69e0a790 [93933.662853] [93933.662856] ---[ end trace 0000000000000000 ]--- [93933.662900] ------------[ cut here ]------------ [93933.662903] kernel BUG at mm/filemap.c:1593! [93933.663301] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [93933.663606] CPU: 21 PID: 246362 Comm: pt_main_thread Kdump: loaded Tainted: P W OE ------ --- 5.14.0-687.15.1.el9_8.x86_64 #1 [93933.664283] Hardware name: Dell Inc. PowerEdge R750xa/, BIOS 1.20.2 01/16/2026 [93933.664667] RIP: 0010:folio_end_writeback+0x7d/0x80 [93933.665062] Code: ff 4d 34 74 12 5d c3 cc cc cc cc f0 80 67 02 fb e8 e8 33 01 00 eb a9 48 89 ef 5d e9 5d 16 01 00 48 89 ee e8 c5 23 02 00 eb d5 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 [93933.665917] RSP: 0018:ff77d49b26d3fc58 EFLAGS: 00010246 [93933.666360] RAX: 0000000000000400 RBX: ff1f8fe082bafe00 RCX: 0000000000204008 [93933.666689] RDX: 0000000000000001 RSI: 0000000000000206 RDI: ff1f8fe808712340 [93933.666948] RBP: ffb7255315772740 R08: 0000000000000206 R09: ff77d49b26d3f9c0 [93933.667201] R10: 0000000000000007 R11: ff1f8fe082bafe00 R12: 0000000000000470 [93933.667464] R13: 0000000000000000 R14: ff77d49b26d3fde0 R15: ff1f8fb10802db00 [93933.667728] FS: 00007f3e5bb01640(0000) GS:ff1f900fafa80000(0000) knlGS:0000000000000000 [93933.667997] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [93933.668271] CR2: 00002ac406c22400 CR3: 0000003089dac006 CR4: 0000000000773ef0 [93933.668539] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [93933.668809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [93933.669080] PKRU: 55555554 [93933.669346] Call Trace: [93933.669608] [93933.669869] ? die+0x33/0x90 [93933.670137] ? do_trap+0xdf/0x110 [93933.670405] ? folio_end_writeback+0x7d/0x80 [93933.670677] ? do_error_trap+0x65/0x80 [93933.670949] ? folio_end_writeback+0x7d/0x80 [93933.671222] ? exc_invalid_op+0x4e/0x70 [93933.671509] ? folio_end_writeback+0x7d/0x80 [93933.671784] ? asm_exc_invalid_op+0x16/0x20 [93933.672061] ? folio_end_writeback+0x7d/0x80 [93933.672333] ? folio_end_writeback+0x1f/0x80 [93933.672602] cifs_writepages+0x998/0xbc0 [cifs] [93933.673028] do_writepages+0xd5/0x1b0 [93933.673310] ? cifs_strict_writev+0x1c4/0x330 [cifs] [93933.673573] filemap_fdatawrite_wbc+0x66/0x90 [93933.673735] __filemap_fdatawrite_range+0x54/0x80 [93933.673898] filemap_write_and_wait_range+0x3e/0xb0 [93933.674052] cifs_flush+0x73/0x120 [cifs] [93933.674291] filp_flush+0x2e/0x80 [93933.674447] __x64_sys_close+0x2e/0x80 [93933.674599] do_syscall_64+0x5f/0xe0 [93933.674752] ? do_user_addr_fault+0x35d/0x6a0 [93933.674909] ? clear_bhb_loop+0x40/0x90 [93933.675062] ? clear_bhb_loop+0x40/0x90 [93933.675213] ? clear_bhb_loop+0x40/0x90 [93933.675364] ? clear_bhb_loop+0x40/0x90 [93933.675509] ? clear_bhb_loop+0x40/0x90 [93933.675650] entry_SYSCALL_64_after_hwframe+0x76/0x7e [93933.675795] RIP: 0033:0x7f3e93903f3b [93933.675935] Code: c3 66 0f 1f 44 00 00 48 8b 15 d9 6e 0f 00 f7 d8 64 89 02 b8 ff ff ff ff eb bc 0f 1f 44 00 00 f3 0f 1e fa b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 a9 6e 0f 00 f7 d8 [93933.676221] RSP: 002b:00007f3e5baff178 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [93933.676366] RAX: ffffffffffffffda RBX: 00007f3d99ab1470 RCX: 00007f3e93903f3b [93933.676506] RDX: 00007f3e939f79e0 RSI: 00000000fbad2404 RDI: 000000000000003e [93933.676642] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [93933.676774] R10: 0000000000000200 R11: 0000000000000202 R12: 00007f3e939f85e0 [93933.676905] R13: 00007f3e55ba4d20 R14: 00007f3e5baff300 R15: 00007f3d69e0a790 [93933.677038] [93933.677167] Modules linked in: binfmt_misc nls_utf8 cifs cifs_arc4 rdma_cm iw_cm ib_cm ib_core cifs_md4 dns_resolver nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink qrtr vfat fat nvidia_uvm(POE) nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common i10nm_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm dell_wmi rapl ledtrig_audio intel_cstate sparse_keymap rfkill iTCO_wdt iTCO_vendor_support dcdbas ipmi_ssif dell_smbios wmi_bmof dell_wmi_descriptor drm_ttm_helper isst_if_mmio isst_if_mbox_pci intel_uncore ttm mei_me pcspkr video isst_if_common intel_th_gth mei i2c_i801 acpi_power_meter intel_th_pci intel_pch_thermal i2c_smbus ipmi_si intel_vsec intel_th acpi_ipmi ipmi_devintf ipmi_msghandler auth_rpcgss sunrpc xfs libcrc32c sd_mod sg mgag200 drm_client_lib [93933.677219] i2c_algo_bit drm_shmem_helper drm_kms_helper ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel drm i40e libata megaraid_sas ghash_clmulni_intel tg3 libie libie_adminq wmi dm_mirror dm_region_hash dm_log dm_mod i2c_dev fuse