The flaw occurs on arm64 Linux when a ptrace session modifies the syscall register (x0) after the seccomp filter has already evaluated it. Because the kernel saves the original value of x0 in pt_regs::orig_x0 before the tracer has had a chance to run, the seccomp check and the associated tracepoints operate on stale data. As a result a process that can be ptraced can change the arguments of a syscall after the filter has passed, enabling it to bypass seccomp restrictions and invoke privileged or otherwise blocked system calls. The weakness lies in improper synchronization of kernel state with tracer updates.

This issue is limited to the arm64 architecture within the Linux kernel. The vendors affected are Linux:Linux. The data does not list specific kernel version ranges, but the defect existed in versions prior to the inclusion of commit a5cd110cb836, which moved the seccomp check to run after the ptrace handler. Any arm64 kernel that had incorporated the original seccomp fix but had not applied the later completion commit may still be susceptible.

Although a CVSS score is not provided and the EPSS score is unavailable, the absence of a KEV listing indicates no known publicly observed exploits at the time of this advisory. Nevertheless, the vulnerability permits a local attacker with ptrace privileges to alter syscall arguments and defeat security filters, which could lead to arbitrary code execution or privilege escalation. The primary attack vector involves a process that can attach via ptrace to a target process that is subject to seccomp policies; this requires local kernel or user privileges. The severity of this flaw is high because the conditions for exploitation are straightforward once ptrace access is available.