{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "a5cd110cb8369d6b37ef5ccfe56b3fa1338c9615"
            },
            {
              "fixed": "8000a5f4d1d192f5bb3e4f29e7606a9460d376df"
            },
            {
              "fixed": "b7afd2a80593dde3f4a68c9a9f73752f9c340e85"
            },
            {
              "fixed": "64ab0964c7db949abbd3c56268a220e2b77f7b9e"
            },
            {
              "fixed": "e59c2476ef755221da31f4e26f6b89712ecf50f1"
            },
            {
              "fixed": "e057b94772328221405b067c3a85fe479b915dc8"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.8.0"
            },
            {
              "fixed": "6.6.148"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.101"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.42"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68171.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: syscall: Ensure saved x0 is kept in-sync with tracer updates\n\nWhen seccomp support was originally added to arm64 in a1ae65b21941\n(\"arm64: add seccomp support\"), seccomp was erroneously called _before_\nthe ptrace syscall-enter-stop and therefore the tracer could trivially\nmanipulate the syscall register state after the seccomp check had\npassed. This was subsequently fixed in a5cd110cb836 (\"arm64/ptrace: run\nseccomp after ptrace\") by moving the seccomp check after the tracer has\nrun. Unfortunately, a decade later, that fix has been reported to be\nincomplete.\n\nOn arm64, both the first argument to a syscall and its eventual return\nvalue are allocated to register x0. In order to facilitate syscall\nrestarting and querying of syscall arguments on the syscall exit path,\nthe original value of x0 is stashed in 'struct pt_regs::orig_x0' early\nduring the syscall entry path and is returned for the first argument by\nsyscall_get_arguments(). Unlike 32-bit Arm, this stashed value is not\ndirectly exposed via ptrace() and so changes to register x0 made by the\ntracer on a syscall-enter-stop are not reflected in 'orig_x0'. This\nmeans that seccomp, syscall tracepoints and audit can observe a stale\nvalue for the register compared to the argument that will be observed by\nthe actual syscall.\n\nRe-sync 'orig_x0' from x0 on the syscall entry path following a\npotential ptrace stop (i.e. PTRACE_EVENTMSG_SYSCALL_ENTRY or\nSECCOMP_RET_TRACE). This behaviour is limited to native tasks (because\ncompat tasks expose 'orig_r0' to ptrace) where the syscall is not being\nskipped (because x0 is updated to hold the return value of -ENOSYS in\nthat case).",
  "id": "CVE-2026-68171",
  "modified": "2026-08-12T03:51:45.154821882Z",
  "published": "2026-08-10T11:59:40.623Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/64ab0964c7db949abbd3c56268a220e2b77f7b9e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8000a5f4d1d192f5bb3e4f29e7606a9460d376df"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b7afd2a80593dde3f4a68c9a9f73752f9c340e85"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e057b94772328221405b067c3a85fe479b915dc8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e59c2476ef755221da31f4e26f6b89712ecf50f1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68171.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68171"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.8.0",
  "summary": "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
}