CVE-2026-63952
Received Received - Intake

memfd SEAL_WRITE Implication Bypass in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means one can use SEAL_EXEC to apply SEAL_WRITE while having writeable mappings. This breaks the contract that SEAL_WRITE provides and can be used by an attacker to pass a memfd that appears to be write sealed but can still be modified arbitrarily. Fix this by adding the implied seals before the call for mapping_deny_writable() is done.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63952
EUVD
EUVD-2026-45725

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the memfd sealing mechanism. When SEAL_EXEC is applied, it should also imply SEAL_WRITE to enforce W^X (write XOR execute) security. However, the implied seal is set after checking for writable mappings, allowing an attacker to bypass write protection. This means a memfd could appear write-sealed but still be modified.

Detection Guidance

This vulnerability is specific to the Linux kernel and does not have a direct network detection method. To check if your system is vulnerable, verify the kernel version and whether it includes the fix for CVE-2026-63952. Use the command: uname -r to check the kernel version. If your kernel version is below the patched version, the system is likely vulnerable.

Impact Analysis

An attacker could exploit this to pass a memfd that seems write-protected but can still be altered. This could lead to arbitrary code execution, privilege escalation, or bypassing security mechanisms relying on write protection.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to memory sealing mechanisms. Compliance risks would only arise if this flaw were exploited to bypass security controls, potentially leading to unauthorized data access or modification.

Mitigation Strategies

Immediately update your Linux kernel to the latest patched version that includes the fix for CVE-2026-63952. If an update is not immediately available, consider disabling memfd functionality temporarily or restricting access to the memfd syscall via kernel parameters or security modules like SELinux or AppArmor.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63952. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart