Executive brief
A flaw in the Linux kernel's PowerPC architecture syscall handling could cause the kernel to incorrectly override error values set by security monitoring tools (seccomp and ptrace). This could prevent proper enforcement of security policies or cause application failures when legitimate syscalls are intercepted and monitored. The issue has been resolved with improved state tracking.
Technical details
The vulnerability exists in the PowerPC syscall exception handler after GENERIC_ENTRY was enabled. When syscall_enter_from_user_mode() returns -1 as a sentinel to indicate seccomp or ptrace interception, system_call_exception() failed to recognize this sentinel and treated -1 as an out-of-range syscall number, returning -ENOSYS and overwriting the errno already set by the intercepting mechanism. The fix introduces a thread flag that is explicitly set by syscall_set_return_value() to distinguish legitimate syscall(-1) calls from injected return values, ensuring that security-supplied return values always suppress syscall execution. The patch handles all seccomp actions (SECCOMP_RET_ERRNO, SECCOMP_RET_TRACE, SECCOMP_RET_USER_NOTIF, SECCOMP_RET_TRAP, SECCOMP_RET_KILL) correctly and covers both ppc32 and ppc64 architectures.
Affected products
- Linux Linux kernel After GENERIC_ENTRY enabled on PowerPC
Timeline
- 2026-09-17: disclosed