Severity: High (CVSS 7.8)
Affected Systems: Linux Linux Kernel
Overview
entry: Fix seccomp bypass after ptrace with TSYNC
A high vulnerability identified as CVE-2026-89603 has been disclosed.
In the Linux kernel, the following vulnerability has been resolved:
entry: Fix seccomp bypass after ptrace with TSYNC
Sashiko review pointed out the following issue.
If a thread is stopped in syscall_trace_enter() for ptrace, another
thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC
(e.g., via seccomp_attach_filter()). This will successfully set
SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter()
evaluates a cached 'work' variable sampled on entry. Consequently,
the subsequent check for SYSCALL_WORK_SECCOMP misses the newly
assigned flag, and the filter is silently bypassed.
This race condition could allow an unprivileged process to execute
a prohibited system call (e.g., execve) that the newly installed filter
was intended to block, especially since the tracer might have modified
the system call number during the ptrace stop.
Fix this by re-reading the syscall_work flags after ptrace handling,
so...
Risk
CVSS and CISA data indicate the following:
- Review the OpenCVE and vendor advisory for exploit conditions and impact
OpenCVE Analysis
CVSS v4.0 N/ACVSS v3.1 7.8 HighCVSS v3.0 N/ACVSS v2 N/AKEV noEPSS yesSSVC no
- OpenCVE title: entry: Fix seccomp bypass after ptrace with TSYNC
- Severity score: High (CVSS 7.8)
- EPSS score: 0.00184
- Weaknesses: CWE-367
| Attack Vector | Local |
| Attack Complexity | High |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Changed |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
Required Action
Review the OpenCVE detail page and linked vendor advisory, then apply the vendor-provided update or mitigation for the affected product.
Prioritize systems where the affected product is internet-facing, handles authentication, or runs with elevated privileges.
Verify Updates
Confirm whether your environment uses the affected product(s): Linux Linux Kernel.
After remediation, verify the installed version against the fixed or unaffected versions listed by the vendor.
Temporary Mitigation (if patch is not available)
Use the mitigation published by the vendor. If no vendor mitigation is available, reduce exposure to the affected product, restrict access to trusted users or networks, and increase monitoring until an update can be applied.
Recommendation
- Use OpenCVE, vendor, and source references as the source of truth for affected versions and remediation
- Patch or mitigate affected products after confirming exposure in your environment
- Monitor affected systems for unusual activity until remediation is complete
Support
If you require assistance, please contact our support team.
Immediate action is strongly recommended to protect your infrastructure.
Source Details
Customer Responsibility and Backups
Before applying updates, mitigations, or configuration changes, customers should take and verify current backups or snapshots of affected systems.
Customers are responsible for managing their servers, validating their own backups, testing changes, and ensuring they can restore services if an update or mitigation causes an issue.
Saturday, September 12, 2026
