A vulnerability in the Linux kernel arm64 architecture allows local authenticated users to bypass security auditing and seccomp filters, potentially leading to unauthorized system actions.

This is an improper synchronization vulnerability within the arm64 ptrace syscall entry path. It allows a local user with low privileges to modify syscall arguments in a way that escapes seccomp and audit oversight.

The ability to bypass seccomp and audit logging mechanisms undermines the integrity of the entire security boundary of the operating system. An attacker could execute prohibited system calls or perform unauthorized operations while remaining undetected by standard security monitoring tools. With a CVSS score of 8.4, this high severity issue represents a significant risk to systems where process isolation and strict syscall enforcement are critical.

Immediate Action: Update the Linux kernel to version 7.2.6 or newer to incorporate the necessary synchronization logic.

Proactive Monitoring: Review system audit logs for unusual ptrace activity or unexpected syscall patterns that may indicate an attempt to bypass security policies.

Compensating Controls: Restrict ptrace capabilities using Linux Security Modules like SELinux or AppArmor, or by setting the kernel.yama.ptrace_scope sysctl to 1 or higher to limit attach permissions.

Public Exploit Available: Unknown

Given the potential for complete bypass of security auditing and seccomp filters, this vulnerability poses a severe risk to system integrity. Administrators should prioritize patching the kernel across all impacted arm64 environments. If immediate updates are not feasible, implement strict ptrace restrictions to minimize the attack surface until the environment can be fully remediated.