Linux kernel arm64 ptrace: tracer-modified x0 escapes seccomp re-evaluation

Impact

On arm64 hosts, a process that can act as a ptracer can change the first syscall argument after a SECCOMP_RET_TRACE stop without the seccomp filter being re-evaluated against the new value, because 'orig_x0' was left stale. The practical effect is that a seccomp filter which allows or denies based on the first argument can be made to approve a call it would have rejected, and audit records the wrong argument. That matters on arm64 GPU nodes (Grace/Grace-Hopper, Ampere, Graviton-class build and inference hosts) where container runtimes and agent sandboxes rely on seccomp argument filtering as a boundary. It is a filter-bypass, not a direct code-execution bug: the attacker still needs ptrace rights over a traced process, which is the normal position of a sandbox supervisor or of a user tracing their own processes inside a pod.

Who can reach it

Local, authenticated. A user or workload that can ptrace a process subject to a seccomp SECCOMP_RET_TRACE filter - typically a process inside the same container or user session. No remote vector, and arm64 only.

What to do

Pick up the fixed stable kernel for your branch (three commits are linked in the record; the fix moves the x0/orig_x0 synchronisation into the ptrace GPR and syscall setters) and reboot the node. Patching requires a node drain and reboot on each affected arm64 host; there is no runtime mitigation other than denying ptrace (for example dropping CAP_SYS_PTRACE and setting a restrictive yama ptrace_scope) in workloads that do not need it. No fixed release numbers are stated in the record, only the commits.

References

Related entries

• Linux kernel virtio-fs: double free of fs->vqs and fs->mq_map when queue setup fails during probeCVE-2026-93827 · Linux kernel virtio-fs (double free on virtio_fs_setup_vqs() probe failure)High
• Intel Data Center GPU driver for VMware ESXi (out-of-bounds read): Out-of-bounds read in the ESXi GPU driver exposingCVE-2026-20751 · Intel Data Center GPU driver for VMware ESXi (out-of-bounds read)High
• Intel Data Center GPU driver for VMware ESXi (out-of-bounds write): Out-of-bounds write in the ESXi GPU driver causingCVE-2026-20879 · Intel Data Center GPU driver for VMware ESXi (out-of-bounds write)High
• wolfSSL: trusted-peer matching ignores the public key, so a forged CA clone verifiesCVE-2026-93302 · wolfSSL MatchTrustedPeer (trusted peer certificate verification)High
• Xen PCI passthrough on Intel VT-d chipsets without interrupt remapping: The founding GPU-passthrough escape. A guestCVE-2011-1898 · Xen PCI passthrough on Intel VT-d chipsets without interrupt remappingHigh
• Xen libxl (xenlight) PCI passthrough device setup: The toolstack hands a bus-mastering-capable PCI device to an HVMCVE-2013-4329 · Xen libxl (xenlight) PCI passthrough device setupHigh