HIGH Introduced in 4.8
arm64 OrigX0 Bypass
CVE-2026-90347
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry Commit e057b9477232 ("arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates") attempted to resolve a long-standing issue with syscall entry tracing, where a tracer is able to manipulate the first syscall argument without being subjected to seccomp or audit checking. Unfortunately, that fix was incomplete [1], as it failed to update 'orig_x0' between a tracer updating x0 during a seccomp ptrace exit (SECCOMP_RET_TRACE) and the seccomp filter being re-evaluated. Rather than add hooks to the core seccomp code, instead move the synchronisation code into the ptrace GPR and syscall setting code so that 'orig_x0' is kept up to date with x0 whenever we're stopped on the syscall entry path.
02KernelScan AI Analysis
Risk summary
A local attacker with ptrace access to a target process on arm64 can modify the tracee's first syscall argument in a way that bypasses seccomp filter re-evaluation, audit logging, and other argument-based checks. This undermines seccomp as a security boundary in sandboxing, container, and multi-tenant deployments. The issue affects all arm64 kernels from version 4.8 onward.
Vulnerability analysis
On arm64, a process tracing another via ptrace can modify the tracee's first syscall argument during a syscall-entry stop, but the kernel's seccomp filter re-evaluation reads a stale saved copy of that argument instead of the modified value. This allows the tracer to bypass seccomp restrictions, audit logging, and other syscall-argument checks that should have applied to the modified argument. The fix synchronizes the saved argument copy with the live register value whenever ptrace updates the tracee's general-purpose registers or syscall number, so seccomp, audit, and the syscall dispatch all observe the same first argument. The vulnerability is reachable locally by any process with ptrace access to the target (same UID or CAP_SYS_PTRACE) on arm64 systems; it requires no special hardware or configuration beyond seccomp being in use on the target process.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 4.8 | 7.2.6 | f433869f2384 |
| mainline | 4.8 | 7.3-rc1 | 88b839ce497c |