CVE-2026-90347

A flaw was found in the Linux kernel. On ARM64 architectures, a vulnerability in the ptrace system call entry tracing mechanism allows a local attacker to manipulate the first system call argument. This manipulation can occur without being subjected to security checks, such as seccomp or audit. This could lead to a security bypass and unauthorized actions.

On arm64, a tracer can modify x0 during a seccomp ptrace stop while orig_x0 remains stale. Seccomp and audit may therefore validate the old first syscall argument while the kernel dispatches the syscall with the new value, allowing a traced process to bypass argument based seccomp restrictions. For the CVSS the PR:L value is used because exploitation requires local code execution and permission to trace the affected task, but it does not require full administrative privileges. The issue is not network reachable and does not directly provide kernel memory corruption or elevated Unix credentials. Impact depends on the sandbox policy and may range from limited policy bypass to substantial confidentiality, integrity, and availability impact when seccomp is the primary isolation boundary.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.