https://seclists.org/oss-sec/2026/q4/400: Seccomp denylist bypass via 32-bit syscall argument truncation
Affected Software
Frequently Asked Questions
Which seccomp rules should be reviewed first?
Review denylist rules that compare a syscall argument against an exact value when the kernel defines that argument as a 32-bit integer. On 64-bit architectures, a full 64-bit equality check without an explicit mask is susceptible to this mismatch.
What does an attacker need to do to bypass a vulnerable comparison?
The caller must supply the prohibited 32-bit value in the low 32 bits of the argument register while setting non-zero bits in the upper 32 bits. Seccomp evaluates the full register value, while the kernel truncates or ignores the upper 32 bits when handling the syscall.
Is this issue limited to socket address-family restrictions?
No. The socket AF_VSOCK example demonstrates the pattern, but the issue applies to many system calls that accept 32-bit integer arguments.
What mitigation is indicated when a vulnerable denylist rule is found?
Apply an explicit mask so the seccomp comparison evaluates the relevant 32-bit argument value rather than the complete 64-bit register value.
How can deployments using the named projects assess exposure?
Audit their seccomp profiles for argument-based denylist checks, particularly exact-value checks on 32-bit syscall arguments. The reported affected projects include containerd, Podman, systemd, and QEMU, but the provided information does not identify specific versions or configurations.