{"id":"CVE-2026-89603","summary":"entry: Fix seccomp bypass after ptrace with TSYNC","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nentry: Fix seccomp bypass after ptrace with TSYNC\n\nSashiko review pointed out the following issue.\n\nIf a thread is stopped in syscall_trace_enter() for ptrace, another\nthread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC\n(e.g., via seccomp_attach_filter()). This will successfully set\nSYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter()\nevaluates a cached 'work' variable sampled on entry. Consequently,\nthe subsequent check for SYSCALL_WORK_SECCOMP misses the newly\nassigned flag, and the filter is silently bypassed.\n\nThis race condition could allow an unprivileged process to execute\na prohibited system call (e.g., execve) that the newly installed filter\nwas intended to block, especially since the tracer might have modified\nthe system call number during the ptrace stop.\n\nFix this by re-reading the syscall_work flags after ptrace handling,\nso that any new SYSCALL_WORK_SECCOMP flag set by another thread via\nTSYNC during the ptrace stop is observed before the subsequent\nseccomp check.","modified":"2026-09-13T03:47:19.584707086Z","published":"2026-09-11T19:45:06.613Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89603.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/459f33f82864723a7fa366cf1091d9c6c893b6b2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4a3591287fb7f808e209b4974ed337f609a2006b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ab4647459098a43e9d6fdb860836f08c962f3774"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89603.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89603"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"142781e108b13b2b0e8f035cfb5bfbbc8f14d887"},{"fixed":"459f33f82864723a7fa366cf1091d9c6c893b6b2"},{"fixed":"ab4647459098a43e9d6fdb860836f08c962f3774"},{"fixed":"4a3591287fb7f808e209b4974ed337f609a2006b"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89603.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.0"},{"fixed":"6.18.51"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89603.json"}}],"schema_version":"1.9.0"}