Executive brief
The Linux kernel's ARM64 processor implementation contains a flaw in how system call argument tracing is handled. When a debugging tool (tracer) modifies the first argument to a system call, a security filter called seccomp may not re-evaluate the syscall with the modified argument. This allows an attacker with debugging privileges to bypass security policies that should reject or audit modified system calls, potentially enabling privilege escalation or unauthorized system call execution.
Technical details
The vulnerability is an incomplete fix for a syscall entry tracing security bypass in ARM64 ptrace handling. The root cause lies in the ptrace subsystem failing to synchronize the 'orig_x0' register (which stores the original first syscall argument) when a tracer modifies x0 during a seccomp ptrace exit event (SECCOMP_RET_TRACE). This allows a tracer to modify syscall arguments after seccomp filtering has passed the initial check but before seccomp re-evaluation, circumventing security policy enforcement. The fix adds synchronization code in the ptrace GPR and syscall setting routines (gpr_set and system_call_set in arch/arm64/kernel/ptrace.c) to keep orig_x0 in sync with x0 whenever stopped on the syscall entry path. Attack requires local ptrace access (debugging capability) and precedes seccomp re-evaluation during SECCOMP_RET_TRACE events.
Affected products
- Linux Linux kernel ARM64 architecture (all versions prior to fix commit 88b839ce497ccb1ff92f7ae742c78dd2937ba572)
Timeline
- 2026-09-17: disclosed: CVE-2026-90347 published on NVD
- 2026-08-02: patched: Fix committed by Will Deacon as 88b839ce497ccb1ff92f7ae742c78dd2937ba572
- 2026-09-14: other: Backported to stable kernel branches