diff --git a/virtio-devices/src/seccomp_filters.rs b/virtio-devices/src/seccomp_filters.rs
index d535c7dcc..c4896d5cf 100644
--- a/virtio-devices/src/seccomp_filters.rs
+++ b/virtio-devices/src/seccomp_filters.rs
@@ -209,6 +209,10 @@ fn virtio_vsock_thread_rules() -> Vec<(i64, Vec<SeccompRule>)> {
         (libc::SYS_ioctl, create_vsock_ioctl_seccomp_rule()),
         (libc::SYS_recvfrom, vec![]),
         (libc::SYS_socket, vec![]),
+        // If debug_assertions is enabled, closing a file first checks
+        // whether the FD is valid with fcntl.
+        #[cfg(debug_assertions)]
+        (libc::SYS_fcntl, vec![]),
     ]
 }