Answer in brief
CVE-2026-89603 records a Unknown severity vulnerability in entry: Fix seccomp bypass after ptrace with TSYNC. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=142781e108b13b2b0e8f035cfb5bfbbc8f14d887 <459f33f82864723a7fa366cf1091d9c6c893b6b2 || >=142781e108b13b2b0e8f035cfb5bfbbc8f14d887 <ab4647459098a43e9d6fdb860836f08c962f3774 || >=142781e108b13b2b0e8f035cfb5bfbbc8f14d887 <4a3591287fb7f808e209b4974ed337f609a2006b | 459f33f82864723a7fa366cf1091d9c6c893b6b2, ab4647459098a43e9d6fdb860836f08c962f3774, 4a3591287fb7f808e209b4974ed337f609a2006b |
| Linux/Linuxgeneric | 5.9 | Not reported |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscall_trace_enter() for ptrace, another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC (e.g., via seccomp_attach_filter()). This will successfully set SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter() evaluates a cached 'work' variable sampled on entry. Consequently, the subsequent check for SYSCALL_WORK_SECCOMP misses the newly assigned flag, and the filter is silently bypassed. This race condition could allow an unprivileged process to execute a prohibited system call (e.g., execve) that the newly installed filter was intended to block, especially since the tracer might have modified the system call number during the ptrace stop. Fix this by re-reading the syscall_work flags after ptrace handling, so that any new SYSCALL_WORK_SECCOMP flag set by another thread via TSYNC during the ptrace stop is observed before the subsequent seccomp check.
Quoted source text, attributed separately from HOL analysis.