CVE-2026-89603

In the Linux kernel, the following vulnerability has been resolved:

entry: Fix seccomp bypass after ptrace with TSYNC

Sashiko review pointed out the following issue.

If a thread is stopped in syscall trace enter() for ptrace, another thread can install a seccomp filter with SECCOMP FILTER FLAG TSYNC (e.g., via seccomp attach filter()). This will successfully set SYSCALL WORK SECCOMP on the stopped thread, but syscall trace enter() evaluates a cached 'work' variable sampled on entry. Consequently, the subsequent check for SYSCALL WORK SECCOMP misses the newly assigned flag, and the filter is silently bypassed.

This race condition could allow an unprivileged process to execute a prohibited system call (e.g., execve) that the newly installed filter was intended to block, especially since the tracer might have modified the system call number during the ptrace stop.

Fix this by re-reading the syscall work flags after ptrace handling, so that any new SYSCALL WORK SECCOMP flag set by another thread via TSYNC during the ptrace stop is observed before the subsequent seccomp check.