CVE-2026-89603: Linux Vulnerability (CVSS 8.4)

Description

In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscall_trace_enter() for ptrace, another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC (e.g., via seccomp_attach_filter()). This will successfully set SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter() evaluates a cached 'work' variable sampled on entry. Consequently, the subsequent check for SYSCALL_WORK_SECCOMP misses the newly assigned flag, and the filter is silently bypassed. This race condition could allow an unprivileged process to execute a prohibited system call (e.g., execve) that the newly installed filter was intended to block, especially since the tracer might have modified the system call number during the ptrace stop. Fix this by re-reading the syscall_work flags after ptrace handling, so that any new SYSCALL_WORK_SECCOMP flag set by another thread via TSYNC during the ptrace stop is observed before the subsequent seccomp check.

Metrics

CVSS 3.1

8.4/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

EPSS Probability

0.14%

3.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 142781e108b13b2b0e8f035cfb5bfbbc8f14d887, < eca5ed4200f0be3e91f8a237b1f37582030a93a8; >= 142781e108b13b2b0e8f035cfb5bfbbc8f14d887, < 8709e7e1dd7d7de0651e61700edf24f5784f9243; >= 142781e108b13b2b0e8f035cfb5bfbbc8f14d887, < 22bb836fc133331982c264227a899d4b26a09706; >= 142781e108b13b2b0e8f035cfb5bfbbc8f14d887, < 23001ee5d8631e30192cde6f6d3ccb6805570499; >= 142781e108b13b2b0e8f035cfb5bfbbc8f14d887, < 09e8880ce5409bdb84da991b053d7087502c181e; >= 142781e108b13b2b0e8f035cfb5bfbbc8f14d887, < 459f33f82864723a7fa366cf1091d9c6c893b6b2; >= 142781e108b13b2b0e8f035cfb5bfbbc8f14d887, < ab4647459098a43e9d6fdb860836f08c962f3774; >= 142781e108b13b2b0e8f035cfb5bfbbc8f14d887, < 4a3591287fb7f808e209b4974ed337f609a2006b
Linux	Linux	5.9

References

Timeline

Published: Sep 11, 2026
Last Modified: Sep 14, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-89603?

In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscall_trace_enter() for ptrace, another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC (e.g., via seccomp_attach_filter()). This will successfully set SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter() evaluates a cached 'work' variable sampled on entry. Consequently, the subsequent check for SYSCALL_WORK_SECCOMP misses the newly assigned flag, and the filter is silently bypassed. This race condition could allow an unprivileged process to execute a prohibited system call (e.g., execve) that the newly installed filter was intended to block, especially since the tracer might have modified the system call number during the ptrace stop. Fix this by re-reading the syscall_work flags after ptrace handling, so that any new SYSCALL_WORK_SECCOMP flag set by another thread via TSYNC during the ptrace stop is observed before the subsequent seccomp check.

How severe is CVE-2026-89603?

CVE-2026-89603 has a CVSS score of 8.4/10 (HIGH severity). The EPSS model estimates a 0.14% probability of exploitation in the next 30 days.

How do I fix CVE-2026-89603?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →