CVE-2026-90347: arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
In the Linux kernel, the following vulnerability has been resolved:
arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry
Commit e057b9477232 ("arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates") attempted to resolve a long-standing issue with syscall entry tracing, where a tracer is able to manipulate the first syscall argument without being subjected to seccomp or audit checking.
Unfortunately, that fix was incomplete [1], as it failed to update 'origx0' between a tracer updating x0 during a seccomp ptrace exit (SECCOMPRETTRACE) and the seccomp filter being re-evaluated.
Rather than add hooks to the core seccomp code, instead move the synchronisation code into the ptrace GPR and syscall setting code so that 'origx0' is kept up to date with x0 whenever we're stopped on the syscall entry path.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch e057b9477232
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux systems on arm64 where syscall entry tracing is used. Exploitation specifically involves a ptrace tracer interacting with seccomp using SECCOMP_RET_TRACE.
What must an attacker be able to do?
An attacker needs the ability to act as a ptrace tracer and modify the traced task's first syscall argument, x0, during a seccomp ptrace exit. The flaw occurs before seccomp re-evaluates the filter using the updated argument.
What is the security impact of modifying x0 in this scenario?
The modified first syscall argument may not receive the intended seccomp or audit checking because orig_x0 is stale. This can allow the tracer to manipulate that argument without the checks being applied to the changed value.
How can I verify that the fix is present?
Check whether the kernel includes either referenced stable commit: f433869f23841a50455c4087d85540d5b4d37cde or 88b839ce497ccb1ff92f7ae742c78dd2937ba572. The fix keeps orig_x0 synchronized with x0 while stopped on the syscall-entry path.