« Volver al listado

CVE-2026-89603

Estado: RecibidaAlta (8.4)—

In the Linux kernel, the following vulnerability has been resolved:

entry: Fix seccomp bypass after ptrace with TSYNC

Sashiko review pointed out the following issue.

If a thread is stopped in syscall_trace_enter() for ptrace, another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC (e.g., via seccomp_attach_filter()). This will successfully set SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter() evaluates a cached 'work' variable sampled on entry. Consequently, the subsequent check for SYSCALL_WORK_SECCOMP misses the newly assigned flag, and the filter is silently bypassed.

Leer descripción completaMostrar menos

This race condition could allow an unprivileged process to execute a prohibited system call (e.g., execve) that the newly installed filter was intended to block, especially since the tracer might have modified the system call number during the ptrace stop.

Fix this by re-reading the syscall_work flags after ptrace handling, so that any new SYSCALL_WORK_SECCOMP flag set by another thread via TSYNC during the ptrace stop is observed before the subsequent seccomp check.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de escalada de privilegios en kernel Linux que permite a proceso sin privilegios eludir filtro seccomp y ejecutar syscalls prohibidas (execve) tras race condition en ptrace+TSYNC.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionPrivileged Account ManagementAuditUpdate SoftwareUser Account ManagementThreat Intelligence Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89603",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "142781e108b13b2b0e8f035cfb5bfbbc8f14d887",
              "lessThan": "eca5ed4200f0be3e91f8a237b1f37582030a93a8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "142781e108b13b2b0e8f035cfb5bfbbc8f14d887",
              "lessThan": "8709e7e1dd7d7de0651e61700edf24f5784f9243",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "142781e108b13b2b0e8f035cfb5bfbbc8f14d887",
              "lessThan": "22bb836fc133331982c264227a899d4b26a09706",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "142781e108b13b2b0e8f035cfb5bfbbc8f14d887",
              "lessThan": "23001ee5d8631e30192cde6f6d3ccb6805570499",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "142781e108b13b2b0e8f035cfb5bfbbc8f14d887",
              "lessThan": "09e8880ce5409bdb84da991b053d7087502c181e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "142781e108b13b2b0e8f035cfb5bfbbc8f14d887",
              "lessThan": "459f33f82864723a7fa366cf1091d9c6c893b6b2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "142781e108b13b2b0e8f035cfb5bfbbc8f14d887",
              "lessThan": "ab4647459098a43e9d6fdb860836f08c962f3774",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "142781e108b13b2b0e8f035cfb5bfbbc8f14d887",
              "lessThan": "4a3591287fb7f808e209b4974ed337f609a2006b",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "include/linux/entry-common.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.9",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/linux/entry-common.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:45.243",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/09e8880ce5409bdb84da991b053d7087502c181e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/22bb836fc133331982c264227a899d4b26a09706",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/23001ee5d8631e30192cde6f6d3ccb6805570499",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/459f33f82864723a7fa366cf1091d9c6c893b6b2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4a3591287fb7f808e209b4974ed337f609a2006b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8709e7e1dd7d7de0651e61700edf24f5784f9243",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ab4647459098a43e9d6fdb860836f08c962f3774",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eca5ed4200f0be3e91f8a237b1f37582030a93a8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nentry: Fix seccomp bypass after ptrace with TSYNC\n\nSashiko review pointed out the following issue.\n\nIf a thread is stopped in syscall_trace_enter() for ptrace, another\nthread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC\n(e.g., via seccomp_attach_filter()). This will successfully set\nSYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter()\nevaluates a cached 'work' variable sampled on entry. Consequently,\nthe subsequent check for SYSCALL_WORK_SECCOMP misses the newly\nassigned flag, and the filter is silently bypassed.\n\nThis race condition could allow an unprivileged process to execute\na prohibited system call (e.g., execve) that the newly installed filter\nwas intended to block, especially since the tracer might have modified\nthe system call number during the ptrace stop.\n\nFix this by re-reading the syscall_work flags after ptrace handling,\nso that any new SYSCALL_WORK_SECCOMP flag set by another thread via\nTSYNC during the ptrace stop is observed before the subsequent\nseccomp check."
    }
  ],
  "lastModified": "2026-09-14T13:19:14.313",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}