{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63952", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.023Z", "datePublished": "2026-07-19T14:55:44.809Z", "dateUpdated": "2026-07-20T13:41:51.115Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-20T13:41:51.115Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemfd: deny writeable mappings when implying SEAL_WRITE\n\nWhen SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the\nimplied seal is set after the check that makes sure the memfd can not have\nany writable mappings. This means one can use SEAL_EXEC to apply\nSEAL_WRITE while having writeable mappings.\n\nThis breaks the contract that SEAL_WRITE provides and can be used by an\nattacker to pass a memfd that appears to be write sealed but can still be\nmodified arbitrarily.\n\nFix this by adding the implied seals before the call for\nmapping_deny_writable() is done."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 8.4, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/memfd.c"], "versions": [{"version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601", "lessThan": "b3f4f82d1315f1439059a83d1c22c51a5b43d99e", "status": "affected", "versionType": "git"}, {"version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601", "lessThan": "3be2a24f7f72ad7321ed6ad1715b956a4527bcf4", "status": "affected", "versionType": "git"}, {"version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601", "lessThan": "0995d1f79aed8ccbf62056189dd53fd19726ea08", "status": "affected", "versionType": "git"}, {"version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601", "lessThan": "555702282d4536a865dfffb1cd4f6028f196e7e8", "status": "affected", "versionType": "git"}, {"version": "c4f75bc8bd6b3d62665e1f5400c419540edb5601", "lessThan": "3b041514cb6eae45869b020f743c14d983363222", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/memfd.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b3f4f82d1315f1439059a83d1c22c51a5b43d99e"}, {"url": "https://git.kernel.org/stable/c/3be2a24f7f72ad7321ed6ad1715b956a4527bcf4"}, {"url": "https://git.kernel.org/stable/c/0995d1f79aed8ccbf62056189dd53fd19726ea08"}, {"url": "https://git.kernel.org/stable/c/555702282d4536a865dfffb1cd4f6028f196e7e8"}, {"url": "https://git.kernel.org/stable/c/3b041514cb6eae45869b020f743c14d983363222"}], "title": "memfd: deny writeable mappings when implying SEAL_WRITE", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: memfd: deny writeable mappings when implying SEAL_WRITE", "id": "2502422", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502422"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-266", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmemfd: deny writeable mappings when implying SEAL_WRITE\nWhen SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the\nimplied seal is set after the check that makes sure the memfd can not have\nany writable mappings. This means one can use SEAL_EXEC to apply\nSEAL_WRITE while having writeable mappings.\nThis breaks the contract that SEAL_WRITE provides and can be used by an\nattacker to pass a memfd that appears to be write sealed but can still be\nmodified arbitrarily.\nFix this by adding the implied seals before the call for\nmapping_deny_writable() is done.", "A flaw was found in the Linux kernel's `memfd` component. When the `SEAL_EXEC` flag is used to create a memory file descriptor, the `SEAL_WRITE` flag is implicitly applied to prevent writing to executable memory. However, this implicit write protection is applied after checks that should deny writable mappings, allowing an attacker to maintain writable access to a `memfd` that appears to be write-sealed. This vulnerability could allow a local attacker to arbitrarily modify memory, potentially leading to privilege escalation or other impacts."], "name": "CVE-2026-63952", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63952\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63952\nhttps://lore.kernel.org/linux-cve-announce/2026071955-CVE-2026-63952-0c7b@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4f75bc8bd6b3d62665e1f5400c419540edb5601,b3f4f82d1315f1439059a83d1c22c51a5b43d99e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4f75bc8bd6b3d62665e1f5400c419540edb5601,3be2a24f7f72ad7321ed6ad1715b956a4527bcf4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4f75bc8bd6b3d62665e1f5400c419540edb5601,0995d1f79aed8ccbf62056189dd53fd19726ea08)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4f75bc8bd6b3d62665e1f5400c419540edb5601,555702282d4536a865dfffb1cd4f6028f196e7e8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4f75bc8bd6b3d62665e1f5400c419540edb5601,3b041514cb6eae45869b020f743c14d983363222)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T07:15:02.605207+00:00", "updated": "2026-07-21T23:15:12.853878+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362"]}