CVE-2026-89603
Received Received - Intake

Race Condition in Linux Kernel Seccomp TSYNC Bypass

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscall_trace_enter() for ptrace, another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC (e.g., via seccomp_attach_filter()). This will successfully set SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter() evaluates a cached 'work' variable sampled on entry. Consequently, the subsequent check for SYSCALL_WORK_SECCOMP misses the newly assigned flag, and the filter is silently bypassed. This race condition could allow an unprivileged process to execute a prohibited system call (e.g., execve) that the newly installed filter was intended to block, especially since the tracer might have modified the system call number during the ptrace stop. Fix this by re-reading the syscall_work flags after ptrace handling, so that any new SYSCALL_WORK_SECCOMP flag set by another thread via TSYNC during the ptrace stop is observed before the subsequent seccomp check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89603
EUVD
EUVD-2026-76515

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in the Linux kernel where a seccomp filter installed by one thread using TSYNC can be bypassed if another thread is stopped during ptrace handling. The issue occurs because the stopped thread uses a cached flag that misses the newly set seccomp work flag, allowing prohibited system calls to execute.

Impact Analysis

An unprivileged process could exploit this to bypass seccomp restrictions and execute system calls that should be blocked, such as execve. This could lead to unauthorized actions or privilege escalation if combined with other vulnerabilities.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for the seccomp bypass issue. Monitor vendor advisories for kernel updates addressing CVE-2026-89603.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart