{"id":"CVE-2026-63952","title":"memfd: deny writeable mappings when implying SEAL_WRITE","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmemfd: deny writeable mappings when implying SEAL_WRITE\n\nWhen SEAL_EXEC is added, SEAL_WRITE is implied to make W^X.  But the\nimplied seal is set after the check that m…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < b3f4f82d1315f1439059a83d1c22c51a5b43d99e","Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < 3be2a24f7f72ad7321ed6ad1715b956a4527bcf4","Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < 0995d1f79aed8ccbf62056189dd53fd19726ea08","Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < 555702282d4536a865dfffb1cd4f6028f196e7e8","Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < 3b041514cb6eae45869b020f743c14d983363222","Linux 6.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:34:10.687690Z"},"published":"2026-07-19","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:42:14.534Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63952","references":[{"url":"https://git.kernel.org/stable/c/b3f4f82d1315f1439059a83d1c22c51a5b43d99e"},{"url":"https://git.kernel.org/stable/c/3be2a24f7f72ad7321ed6ad1715b956a4527bcf4"},{"url":"https://git.kernel.org/stable/c/0995d1f79aed8ccbf62056189dd53fd19726ea08"},{"url":"https://git.kernel.org/stable/c/555702282d4536a865dfffb1cd4f6028f196e7e8"},{"url":"https://git.kernel.org/stable/c/3b041514cb6eae45869b020f743c14d983363222"}],"tags":["cve.org"],"epss":0.00164,"epssPercentile":0.05285,"ingestedAt":"2026-10-16T17:24:46.784Z","slug":"CVE-2026-63952","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmemfd: deny writeable mappings when implying SEAL_WRITE\n\nWhen SEAL_EXEC is added, SEAL_WRITE is implied to make W^X.  But the\nimplied seal is set after the check that makes sure the memfd can not have\nany writable mappings.  This means one can use SEAL_EXEC to apply\nSEAL_WRITE while having writeable mappings.\n\nThis breaks the contract that SEAL_WRITE provides and can be used by an\nattacker to pass a memfd that appears to be write sealed but can still be\nmodified arbitrarily.\n\nFix this by adding the implied seals before the call for\nmapping_deny_writable() is done.\n\n## Affected\n\n- `Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < b3f4f82d1315f1439059a83d1c22c51a5b43d99e`\n- `Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < 3be2a24f7f72ad7321ed6ad1715b956a4527bcf4`\n- `Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < 0995d1f79aed8ccbf62056189dd53fd19726ea08`\n- `Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < 555702282d4536a865dfffb1cd4f6028f196e7e8`\n- `Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < 3b041514cb6eae45869b020f743c14d983363222`\n- `Linux 6.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}