)]}'
{
  "commit": "2c8ba6aac7a4075ebfccf6c1fdb39ab4dc46d806",
  "tree": "1d4ddd1981dc53d98e97f622ffd2efc70784f82c",
  "parents": [
    "e4daa1417c6def741ea59deac8fea913924979ad"
  ],
  "author": {
    "name": "Will Deacon",
    "email": "will@kernel.org",
    "time": "Thu Jul 16 13:06:39 2026 +0100"
  },
  "committer": {
    "name": "Kevin Liu",
    "email": "zhihuil@google.com",
    "time": "Thu Aug 20 19:02:35 2026 -0700"
  },
  "message": "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates\n\ncommit e057b94772328221405b067c3a85fe479b915dc8 upstream.\n\nWhen seccomp support was originally added to arm64 in a1ae65b21941\n(\"arm64: add seccomp support\"), seccomp was erroneously called _before_\nthe ptrace syscall-enter-stop and therefore the tracer could trivially\nmanipulate the syscall register state after the seccomp check had\npassed. This was subsequently fixed in a5cd110cb836 (\"arm64/ptrace: run\nseccomp after ptrace\") by moving the seccomp check after the tracer has\nrun. Unfortunately, a decade later, that fix has been reported to be\nincomplete.\n\nOn arm64, both the first argument to a syscall and its eventual return\nvalue are allocated to register x0. In order to facilitate syscall\nrestarting and querying of syscall arguments on the syscall exit path,\nthe original value of x0 is stashed in \u0027struct pt_regs::orig_x0\u0027 early\nduring the syscall entry path and is returned for the first argument by\nsyscall_get_arguments(). Unlike 32-bit Arm, this stashed value is not\ndirectly exposed via ptrace() and so changes to register x0 made by the\ntracer on a syscall-enter-stop are not reflected in \u0027orig_x0\u0027. This\nmeans that seccomp, syscall tracepoints and audit can observe a stale\nvalue for the register compared to the argument that will be observed by\nthe actual syscall.\n\nRe-sync \u0027orig_x0\u0027 from x0 on the syscall entry path following a\npotential ptrace stop (i.e. PTRACE_EVENTMSG_SYSCALL_ENTRY or\nSECCOMP_RET_TRACE). This behaviour is limited to native tasks (because\ncompat tasks expose \u0027orig_r0\u0027 to ptrace) where the syscall is not being\nskipped (because x0 is updated to hold the return value of -ENOSYS in\nthat case).\n\nBUG\u003db/545103032\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-68171 in the Linux kernel.\n\ncos-patch: security-moderate\nCc: Kees Cook \u003ckees@kernel.org\u003e\nCc: Jinjie Ruan \u003cruanjinjie@huawei.com\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: stable@vger.kernel.org\nReported-by: Yiqi Sun \u003csunyiqixm@gmail.com\u003e\nLink: https://lore.kernel.org/all/20260529065444.1336608-1-sunyiqixm@gmail.com/\nSuggested-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nFixes: a5cd110cb836 (\"arm64/ptrace: run seccomp after ptrace\")\nReviewed-by: Jinjie Ruan \u003cruanjinjie@huawei.com\u003e\nTested-by: Jinjie Ruan \u003cruanjinjie@huawei.com\u003e\nChange-Id: I38c5e4545b01735f8633eb1b5729478a643ebd41\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/185808\nReviewed-by: Derek Taylor \u003cddtaylor@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Kevin Liu \u003czhihuil@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c30f5a70bd18f432c2dabe8e52cef09fb79717b0",
      "old_mode": 33188,
      "old_path": "arch/arm64/kernel/ptrace.c",
      "new_id": "88a6de62d53249085624c81b856f375312c205e0",
      "new_mode": 33188,
      "new_path": "arch/arm64/kernel/ptrace.c"
    }
  ]
}