Executive brief
The Linux kernel's seccomp security module contains a race condition that can allow an unprivileged user to bypass security restrictions. If a thread is paused during system call tracing, another thread can install a seccomp filter intended to block dangerous operations like execve, but the paused thread will not see this filter and can execute the prohibited system call. This could be exploited to perform unauthorized actions on systems using seccomp for application sandboxing.
Technical details
The vulnerability is a race condition in the syscall entry code (kernel/entry/common.c). When a thread is stopped in syscall_trace_enter() during ptrace handling, another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC, which sets SYSCALL_WORK_SECCOMP on the stopped thread. However, the code caches the syscall_work flags at entry, so the newly set flag is not observed and the filter is silently bypassed. An attacker can execute a prohibited system call that should be blocked. The fix re-reads the syscall_work flags after ptrace handling via READ_ONCE(current_thread_info()->syscall_work) to ensure any TSYNC-installed flags are observed. The patch affects stable kernels from 2.6.11 through 7.2.
Affected products
- Linux Linux kernel 2.6.11 through 7.2 (all stable branches)
Timeline
- 2026-09-11: disclosed
- 2026-09-14: patched