{"api_version":"1","generated_at":"2026-09-11T23:53:31+00:00","cve":"CVE-2026-89603","urls":{"html":"https://cve.report/CVE-2026-89603","api":"https://cve.report/api/cve/CVE-2026-89603.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89603","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89603"},"summary":{"title":"entry: Fix seccomp bypass after ptrace with TSYNC","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nentry: Fix seccomp bypass after ptrace with TSYNC\n\nSashiko review pointed out the following issue.\n\nIf a thread is stopped in syscall_trace_enter() for ptrace, another\nthread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC\n(e.g., via seccomp_attach_filter()). This will successfully set\nSYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter()\nevaluates a cached 'work' variable sampled on entry. Consequently,\nthe subsequent check for SYSCALL_WORK_SECCOMP misses the newly\nassigned flag, and the filter is silently bypassed.\n\nThis race condition could allow an unprivileged process to execute\na prohibited system call (e.g., execve) that the newly installed filter\nwas intended to block, especially since the tracer might have modified\nthe system call number during the ptrace stop.\n\nFix this by re-reading the syscall_work flags after ptrace handling,\nso that any new SYSCALL_WORK_SECCOMP flag set by another thread via\nTSYNC during the ptrace stop is observed before the subsequent\nseccomp check.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-11 20:19:45","updated_at":"2026-09-11 20:19:45"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/459f33f82864723a7fa366cf1091d9c6c893b6b2","name":"https://git.kernel.org/stable/c/459f33f82864723a7fa366cf1091d9c6c893b6b2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4a3591287fb7f808e209b4974ed337f609a2006b","name":"https://git.kernel.org/stable/c/4a3591287fb7f808e209b4974ed337f609a2006b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ab4647459098a43e9d6fdb860836f08c962f3774","name":"https://git.kernel.org/stable/c/ab4647459098a43e9d6fdb860836f08c962f3774","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89603","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89603","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 142781e108b13b2b0e8f035cfb5bfbbc8f14d887 459f33f82864723a7fa366cf1091d9c6c893b6b2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 142781e108b13b2b0e8f035cfb5bfbbc8f14d887 ab4647459098a43e9d6fdb860836f08c962f3774 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 142781e108b13b2b0e8f035cfb5bfbbc8f14d887 4a3591287fb7f808e209b4974ed337f609a2006b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.9","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.9 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.51 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.4 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/entry-common.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"459f33f82864723a7fa366cf1091d9c6c893b6b2","status":"affected","version":"142781e108b13b2b0e8f035cfb5bfbbc8f14d887","versionType":"git"},{"lessThan":"ab4647459098a43e9d6fdb860836f08c962f3774","status":"affected","version":"142781e108b13b2b0e8f035cfb5bfbbc8f14d887","versionType":"git"},{"lessThan":"4a3591287fb7f808e209b4974ed337f609a2006b","status":"affected","version":"142781e108b13b2b0e8f035cfb5bfbbc8f14d887","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/entry-common.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.51","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.51","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.4","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"5.9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nentry: Fix seccomp bypass after ptrace with TSYNC\n\nSashiko review pointed out the following issue.\n\nIf a thread is stopped in syscall_trace_enter() for ptrace, another\nthread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC\n(e.g., via seccomp_attach_filter()). This will successfully set\nSYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter()\nevaluates a cached 'work' variable sampled on entry. Consequently,\nthe subsequent check for SYSCALL_WORK_SECCOMP misses the newly\nassigned flag, and the filter is silently bypassed.\n\nThis race condition could allow an unprivileged process to execute\na prohibited system call (e.g., execve) that the newly installed filter\nwas intended to block, especially since the tracer might have modified\nthe system call number during the ptrace stop.\n\nFix this by re-reading the syscall_work flags after ptrace handling,\nso that any new SYSCALL_WORK_SECCOMP flag set by another thread via\nTSYNC during the ptrace stop is observed before the subsequent\nseccomp check."}],"providerMetadata":{"dateUpdated":"2026-09-11T19:45:06.613Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/459f33f82864723a7fa366cf1091d9c6c893b6b2"},{"url":"https://git.kernel.org/stable/c/ab4647459098a43e9d6fdb860836f08c962f3774"},{"url":"https://git.kernel.org/stable/c/4a3591287fb7f808e209b4974ed337f609a2006b"}],"title":"entry: Fix seccomp bypass after ptrace with TSYNC","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89603","datePublished":"2026-09-11T19:45:06.613Z","dateReserved":"2026-09-11T19:38:34.732Z","dateUpdated":"2026-09-11T19:45:06.613Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-11 20:19:45","lastModifiedDate":"2026-09-11 20:19:45","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89603","Ordinal":"1","Title":"entry: Fix seccomp bypass after ptrace with TSYNC","CVE":"CVE-2026-89603","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89603","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nentry: Fix seccomp bypass after ptrace with TSYNC\n\nSashiko review pointed out the following issue.\n\nIf a thread is stopped in syscall_trace_enter() for ptrace, another\nthread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC\n(e.g., via seccomp_attach_filter()). This will successfully set\nSYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter()\nevaluates a cached 'work' variable sampled on entry. Consequently,\nthe subsequent check for SYSCALL_WORK_SECCOMP misses the newly\nassigned flag, and the filter is silently bypassed.\n\nThis race condition could allow an unprivileged process to execute\na prohibited system call (e.g., execve) that the newly installed filter\nwas intended to block, especially since the tracer might have modified\nthe system call number during the ptrace stop.\n\nFix this by re-reading the syscall_work flags after ptrace handling,\nso that any new SYSCALL_WORK_SECCOMP flag set by another thread via\nTSYNC during the ptrace stop is observed before the subsequent\nseccomp check.","Type":"Description","Title":"entry: Fix seccomp bypass after ptrace with TSYNC"}]}}}