---
id: CVE-2026-63952
title: 'memfd: deny writeable mappings when implying SEAL_WRITE'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  memfd: deny writeable mappings when implying SEAL_WRITE

  When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X.  But the
  implied seal is set after the check that m…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 <
    b3f4f82d1315f1439059a83d1c22c51a5b43d99e
  - >-
    Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 <
    3be2a24f7f72ad7321ed6ad1715b956a4527bcf4
  - >-
    Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 <
    0995d1f79aed8ccbf62056189dd53fd19726ea08
  - >-
    Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 <
    555702282d4536a865dfffb1cd4f6028f196e7e8
  - >-
    Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 <
    3b041514cb6eae45869b020f743c14d983363222
  - Linux 6.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:34:10.687690Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:14.534Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63952'
references:
  - url: 'https://git.kernel.org/stable/c/b3f4f82d1315f1439059a83d1c22c51a5b43d99e'
  - url: 'https://git.kernel.org/stable/c/3be2a24f7f72ad7321ed6ad1715b956a4527bcf4'
  - url: 'https://git.kernel.org/stable/c/0995d1f79aed8ccbf62056189dd53fd19726ea08'
  - url: 'https://git.kernel.org/stable/c/555702282d4536a865dfffb1cd4f6028f196e7e8'
  - url: 'https://git.kernel.org/stable/c/3b041514cb6eae45869b020f743c14d983363222'
tags:
  - cve.org
epss: 0.00164
epssPercentile: 0.05285
ingestedAt: '2026-10-16T17:24:46.784Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

memfd: deny writeable mappings when implying SEAL_WRITE

When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X.  But the
implied seal is set after the check that makes sure the memfd can not have
any writable mappings.  This means one can use SEAL_EXEC to apply
SEAL_WRITE while having writeable mappings.

This breaks the contract that SEAL_WRITE provides and can be used by an
attacker to pass a memfd that appears to be write sealed but can still be
modified arbitrarily.

Fix this by adding the implied seals before the call for
mapping_deny_writable() is done.

## Affected

- `Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < b3f4f82d1315f1439059a83d1c22c51a5b43d99e`
- `Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < 3be2a24f7f72ad7321ed6ad1715b956a4527bcf4`
- `Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < 0995d1f79aed8ccbf62056189dd53fd19726ea08`
- `Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < 555702282d4536a865dfffb1cd4f6028f196e7e8`
- `Linux >= c4f75bc8bd6b3d62665e1f5400c419540edb5601 < 3b041514cb6eae45869b020f743c14d983363222`
- `Linux 6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.