Cyber ·
Seccomp blocklist bypass through truncation of 32-bit system call argument
An oss-sec notice dated October 27, 2026 describes a seccomp filter bypass affecting containerd, Podman, systemd and QEMU, caused by truncation of 32-bit integer arguments on 64-bit architectures.
A notice posted to the oss-sec list on October 27, 2026 describes a seccomp filter bypass pattern affecting several projects, named as containerd, Podman, systemd and QEMU. These projects use blocklists to inspect system call arguments. According to the text, the problem stems from an evaluation mismatch between seccomp-bpf and the Linux kernel when 32-bit integer arguments are passed in 64-bit CPU registers on 64-bit architectures. The excerpt received is truncated, so affected versions, exploitation conditions and fixes do not appear here. Relevance: seccomp filters are part of container and process isolation, and a flaw in that mechanism weakens confidence in that isolation. Rota Nacional does not fix this problem or resolve the engineering flaw described; the fix belongs to each project, through its vendor's update channels. How to consult and verify: open the official oss-sec list archive indicated in the source, check the date and authorship in the original, and follow the advisories of the projects named. If your team uses AI to study or summarize this notice, do not paste configurations with credentials, internal logs or personal data. Use the automatic personal data detection and the organization's marker, removal or block policy, and keep the audit record according to internal policy.