---
id: CVE-2026-89603
title: 'kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)'
summary: >-
  A flaw was found in the Linux kernel. A race condition exists where a seccomp
  filter, intended to restrict system calls, can be bypassed by an unprivileged
  process. This occurs when a thread is stopped for tracing (ptrace) and another
  thre…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe: CWE-367
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 9
  - openshift_container_platform 4
published: '2026-09-11'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T12:45:58+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89603.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89603.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89603'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532493'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89603'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89603'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89603.mbox
  - url: 'https://git.kernel.org/stable/c/eca5ed4200f0be3e91f8a237b1f37582030a93a8'
  - url: 'https://git.kernel.org/stable/c/8709e7e1dd7d7de0651e61700edf24f5784f9243'
  - url: 'https://git.kernel.org/stable/c/22bb836fc133331982c264227a899d4b26a09706'
  - url: 'https://git.kernel.org/stable/c/23001ee5d8631e30192cde6f6d3ccb6805570499'
  - url: 'https://git.kernel.org/stable/c/09e8880ce5409bdb84da991b053d7087502c181e'
  - url: 'https://git.kernel.org/stable/c/459f33f82864723a7fa366cf1091d9c6c893b6b2'
  - url: 'https://git.kernel.org/stable/c/ab4647459098a43e9d6fdb860836f08c962f3774'
  - url: 'https://git.kernel.org/stable/c/4a3591287fb7f808e209b4974ed337f609a2006b'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00181
epssPercentile: 0.06769
scores:
  vendor: 7
  cna: 8.4
ingestedAt: '2026-09-14T15:23:07.451Z'
---

## Overview

A flaw was found in the Linux kernel. A race condition exists where a seccomp filter, intended to restrict system calls, can be bypassed by an unprivileged process. This occurs when a thread is stopped for tracing (ptrace) and another thread attempts to apply a seccomp filter with the `SECCOMP_FILTER_FLAG_TSYNC` flag. Due to a caching issue, the newly installed filter is not properly enforced, allowing the unprivileged process to execute system calls that should have been blocked, potentially leading to a security bypass.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89603.json)

**kernel: entry: Fix seccomp bypass after ptrace with TSYNC** — rated Important by Red Hat. Released 2026-09-11, updated 2026-09-15.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

Not affected:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 4

## Remediation

Affected