PT-2026-61269 · Linux · Linux

CVE-2026-63952 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

In the Linux kernel, the following vulnerability has been resolved:

memfd: deny writeable mappings when implying SEAL WRITE

When SEAL EXEC is added, SEAL WRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means one can use SEAL EXEC to apply SEAL WRITE while having writeable mappings.

This breaks the contract that SEAL WRITE provides and can be used by an attacker to pass a memfd that appears to be write sealed but can still be modified arbitrarily.

Fix this by adding the implied seals before the call for mapping deny writable() is done.

Fix

Related Identifiers

CVE-2026-63952

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-63952 · Security Note
• https://git.kernel.org/stable/c/555702282d4536a865dfffb1cd4f6028f196e7e8 · Note
• https://git.kernel.org/stable/c/3b041514cb6eae45869b020f743c14d983363222 · Note
• https://git.kernel.org/stable/c/b3f4f82d1315f1439059a83d1c22c51a5b43d99e · Note
• https://git.kernel.org/stable/c/3be2a24f7f72ad7321ed6ad1715b956a4527bcf4 · Note
• https://git.kernel.org/stable/c/0995d1f79aed8ccbf62056189dd53fd19726ea08 · Note