CVE-2026-89603

kernel: Linux kernel: Seccomp bypass allows unprivileged processes to execute prohibited system calls

View on CVE.org

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed

Description

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Analysis

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Affected Products

No data.

No data available yet.

Remediation

No remediation available yet

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/459f33f82864723a7fa366cf1091d9c6c893b6b2
https://git.kernel.org/stable/c/4a3591287fb7f808e209b4974ed337f609a2006b
https://git.kernel.org/stable/c/ab4647459098a43e9d6fdb860836f08c962f3774
https://nvd.nist.gov/vuln/detail/CVE-2026-89603
https://www.cve.org/CVERecord?id=CVE-2026-89603

History

Oct 16, 2026 7:30 AM References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
References	https://git.kernel.org/stable/c/09e8880ce5409bdb84da991b053d7087502c181e https://git.kernel.org/stable/c/22bb836fc133331982c264227a899d4b26a09706 https://git.kernel.org/stable/c/23001ee5d8631e30192cde6f6d3ccb6805570499 https://git.kernel.org/stable/c/8709e7e1dd7d7de0651e61700edf24f5784f9243 https://git.kernel.org/stable/c/eca5ed4200f0be3e91f8a237b1f37582030a93a8
Metrics	cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

Oct 16, 2026 7:00 AM Description updated. Title updated. Affected versions updated View changes

Type	Values Removed	Values Added
Description	In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscall_trace_enter() for ptrace, another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC (e.g., via seccomp_attach_filter()). This will successfully set SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter() evaluates a cached 'work' variable sampled on entry. Consequently, the subsequent check for SYSCALL_WORK_SECCOMP misses the newly assigned flag, and the filter is silently bypassed. This race condition could allow an unprivileged process to execute a prohibited system call (e.g., execve) that the newly installed filter was intended to block, especially since the tracer might have modified the system call number during the ptrace stop. Fix this by re-reading the syscall_work flags after ptrace handling, so that any new SYSCALL_WORK_SECCOMP flag set by another thread via TSYNC during the ptrace stop is observed before the subsequent seccomp check.	This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Title	entry: Fix seccomp bypass after ptrace with TSYNC	kernel: Linux kernel: Seccomp bypass allows unprivileged processes to execute prohibited system calls
CPEs	cpe:2.3:o:linux:linux_kernel::::::::

Sep 14, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/09e8880ce5409bdb84da991b053d7087502c181e https://git.kernel.org/stable/c/22bb836fc133331982c264227a899d4b26a09706 https://git.kernel.org/stable/c/23001ee5d8631e30192cde6f6d3ccb6805570499 https://git.kernel.org/stable/c/8709e7e1dd7d7de0651e61700edf24f5784f9243 https://git.kernel.org/stable/c/eca5ed4200f0be3e91f8a237b1f37582030a93a8

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'}`

Sep 12, 2026 5:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-362

Sep 12, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89603 https://www.cve.org/CVERecord?id=CVE-2026-89603
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}` threat_severity `Moderate`

Sep 12, 2026 10:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscall_trace_enter() for ptrace, another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC (e.g., via seccomp_attach_filter()). This will successfully set SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter() evaluates a cached 'work' variable sampled on entry. Consequently, the subsequent check for SYSCALL_WORK_SECCOMP misses the newly assigned flag, and the filter is silently bypassed. This race condition could allow an unprivileged process to execute a prohibited system call (e.g., execve) that the newly installed filter was intended to block, especially since the tracer might have modified the system call number during the ptrace stop. Fix this by re-reading the syscall_work flags after ptrace handling, so that any new SYSCALL_WORK_SECCOMP flag set by another thread via TSYNC during the ptrace stop is observed before the subsequent seccomp check.
Title		entry: Fix seccomp bypass after ptrace with TSYNC
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/459f33f82864723a7fa366cf1091d9c6c893b6b2 https://git.kernel.org/stable/c/4a3591287fb7f808e209b4974ed337f609a2006b https://git.kernel.org/stable/c/ab4647459098a43e9d6fdb860836f08c962f3774