CVE-2026-90339

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/syscall: Fix syscall skip handling for seccomp and ptrace

After enabling GENERIC_ENTRY on PowerPC, syscall_enter_from_user_mode()

returns -1 as a sentinel to signal that seccomp or ptrace has intercepted

the syscall and already set a return value via syscall_set_return_value().

system_call_exception() was not handling this sentinel, and since -1UL

is >= NR_syscalls, the code fell into the out-of-range path and returned

-ENOSYS, overwriting the errno already placed in regs->gpr[3].

The naive fix of checking r0 == -1L before the NR_syscalls bounds check

is ambiguous: a user legitimately calling syscall(-1) also produces r0 ==

-1L, and a tracer intercepting such a call would have its injected return

value silently discarded.

Fix this by introducing a thread flag that is set whenever

syscall_set_return_value() explicitly updates the return value. In

system_call_exception(), check and clear this flag before disp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References