diff --git a/NEWS b/NEWS
index c64ef5871b..c76b571d2b 100644
--- a/NEWS
+++ b/NEWS
@@ -25,6 +25,10 @@ CHANGES WITH 241 in spe:
         * kernel-install script now optionally takes a path to an initrd file,
           and passes it to all plugins.
 
+        * The mincore() system call has been dropped from the @system-service
+          system call filter group, as it is pretty exotic and may potentially
+          used for side-channel attacks.
+
         * -fPIE is dropped from compiler and linker options. Please specify
           -Db_pie=true option to meson to build position-independent
           executables. Note that the meson option is supported since meson-0.49.
diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index 42d6dd2a94..cc58b3c078 100644
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -793,7 +793,6 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 "ioprio_get\0"
                 "kcmp\0"
                 "madvise\0"
-                "mincore\0"
                 "mprotect\0"
                 "mremap\0"
                 "name_to_handle_at\0"