libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators , which might able to lead to bypassing seccomp filters and potential privilege escalations