---
id: CVE-2026-90347
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry

  Commit e057b9477232 ("arm64: syscall: Ensure saved x0 is kept in-sync
  with tracer updates") attempted to…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry

  Commit e057b9477232 ("arm64: syscall: Ensure saved x0 is kept in-sync
  with tracer updates") attempted to…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615 <
    f433869f23841a50455c4087d85540d5b4d37cde
  - >-
    Linux >= a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615 <
    88b839ce497ccb1ff92f7ae742c78dd2937ba572
  - Linux 4.8
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:54.883'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90347'
references:
  - url: 'https://git.kernel.org/stable/c/88b839ce497ccb1ff92f7ae742c78dd2937ba572'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f433869f23841a50455c4087d85540d5b4d37cde'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00163
epssPercentile: 0.04824
ingestedAt: '2026-09-17T16:21:47.816Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry

Commit e057b9477232 ("arm64: syscall: Ensure saved x0 is kept in-sync
with tracer updates") attempted to resolve a long-standing issue with
syscall entry tracing, where a tracer is able to manipulate the first
syscall argument without being subjected to seccomp or audit checking.

Unfortunately, that fix was incomplete [1], as it failed to update
'orig_x0' between a tracer updating x0 during a seccomp ptrace exit
(SECCOMP_RET_TRACE) and the seccomp filter being re-evaluated.

Rather than add hooks to the core seccomp code, instead move the
synchronisation code into the ptrace GPR and syscall setting code so
that 'orig_x0' is kept up to date with x0 whenever we're stopped on the
syscall entry path.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.