EUVD-2026-76515
GHSA-qx6x-jhp8-p5pv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Local low-privilege process exploits a stable ptrace-stop window (AC:L); seccomp boundary crossed (S:C); no availability impact; matches given vendor vector.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
entry: Fix seccomp bypass after ptrace with TSYNC
Sashiko review pointed out the following issue.
If a thread is stopped in syscall_trace_enter() for ptrace, another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC (e.g., via seccomp_attach_filter()). This will successfully set SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter() evaluates a cached 'work' variable sampled on entry. Consequently, the subsequent check for SYSCALL_WORK_SECCOMP misses the newly assigned flag, and the filter is silently bypassed.
This race condition could allow an unprivileged process to execute a prohibited system call (e.g., execve) that the newly installed filter was intended to block, especially since the tracer might have modified the system call number during the ptrace stop.
Fix this by re-reading the syscall_work flags after ptrace handling, so that any new SYSCALL_WORK_SECCOMP flag set by another thread via TSYNC during the ptrace stop is observed before the subsequent seccomp check.
AnalysisAI
Seccomp filter bypass in the Linux kernel entry path allows a low-privileged local process to execute syscalls blocked by a newly installed seccomp filter. The vulnerability arises because syscall_trace_enter() caches the syscall_work flags at entry; when a sibling thread installs a seccomp filter via SECCOMP_FILTER_FLAG_TSYNC while the first thread is ptrace-stopped, the SYSCALL_WORK_SECCOMP flag is set on the stopped thread but the stale cached variable never reflects it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the attacker controls a multi-threaded process where one thread has an active ptrace-stop relationship (either as tracee or where the attacker controls the tracer); (2) the ptrace stop must occur specifically inside `syscall_trace_enter()` during the syscall entry path - `PTRACE_SYSCALL` or `PTRACE_SYSEMU` attachment is needed; (3) a sibling thread in the same thread group must issue `seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, ...)` while the first thread is in that ptrace-stopped state; (4) the tracer must modify the syscall number during the stop to target a syscall the new filter blocks. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (8.4) is broadly accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Linux 6.18.51, 7.2.4, and 7.3-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Enumerate all production systems running affected Linux kernels with seccomp filters enabled, prioritizing container hosts and systems running untrusted workloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today