This looks like a good candidate for 5.8.0: https://github.com/osquery/osquery/pull/7916. I could review it but I'm not very familiar with the relevant systems.

+1. For what it's worth it, we got reports from at least ~three users hitting this issue on Linux hosts.