A race condition in the Linux kernel enables a thread halted in the ptrace stop to miss a newly installed seccomp filter. When a second thread attaches a TSYNC‑enabled filter during the stop, the original thread reads a stale flag, causing the seccomp check to be omitted. The flaw permits execution of system calls that a properly installed filter would block, such as execve. This issue is a classic concurrency weakness, reflected in CWE‑362 and CWE‑367.

All Linux kernel releases prior to the commit that re‑reads syscall_work flags after ptrace handling are affected. The vulnerability is listed for the generic Linux kernel product; no specific kernel versions are enumerated, so any build released before the patch remains at risk.

The CVSS score of 7.8 indicates high severity, while the EPSS score of <1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector, based on the description, requires a process with ptrace privileges that can stop a target thread while concurrently another thread installs a TSYNC‑enabled seccomp filter. If ptrace usage is restricted on a system, the opportunity for exploitation diminishes significantly. For systems that allow broad ptrace access, the race flaw could be exploited by an unprivileged user to execute prohibited system calls.