A flaw was found in containers-common (Podman/container-libs default seccomp profile). Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket(2) integer arguments with unmasked 64-bit equality. On 64-bit architectures the kernel uses only the low 32 bits, so values such as AF_VSOCK|1<<32 bypass the deny rule while still creating the restricted socket type. This is confirmed in RHEL 9 and RHEL 10 containers-common seccomp.json. SELinux may still block some of these operations on enforcing hosts, but the seccomp profile itself does not enforce the intended restriction.