SB20260912174 - Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel syscall_trace_enter()

Description

This security bulletin contains information about 1 vulnerability.

1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-89603)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute system calls prohibited by a seccomp filter.

The vulnerability exists due to a race condition in syscall_trace_enter() when a thread is stopped for ptrace while another thread installs a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC. A local user can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC while another thread is stopped for ptrace to execute system calls prohibited by the filter.

The system call number may be modified during ptrace handling.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/459f33f82864723a7fa366cf1091d9c6c893b6b2
• https://git.kernel.org/stable/c/4a3591287fb7f808e209b4974ed337f609a2006b
• https://git.kernel.org/stable/c/ab4647459098a43e9d6fdb860836f08c962f3774