CVE-2026-63952 memfd: deny writeable mappings when implying SEAL_WRITE
An attacker can bypass memfd write seals by exploiting a race condition in SEAL_EXEC handling, allowing arbitrary modification of supposedly read-only memory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63952?
CVE-2026-63952 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
memfd: deny writeable mappings when implying SEAL_WRITE
When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means one can use SEAL_EXEC to apply SEAL_WRITE while having writeable mappings.
This breaks the contract that SEAL_WRITE provides and can be used by an attacker to pass a memfd that appears to be write sealed but can still be modified arbitrarily.
Fix this by adding the implied seals before the call for mapping_deny_writable() is done.
Weakness: CWE-362
Which versions are affected by CVE-2026-63952?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-63952?
Apply the vendor's patch.
Is CVE-2026-63952 being exploited?
There is no known exploitation of CVE-2026-63952 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-63952, DEBIAN-CVE-2026-63952, GHSA-6pc4-h32v-99rg, UBUNTU-CVE-2026-63952.