CVE-2026-63952

When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means one can use SEALEXEC to apply SEALWRITE while having writeable mappings.

This breaks the contract that SEAL_WRITE provides and can be used by an attacker to pass a memfd that appears to be write sealed but can still be modified arbitrarily.

Fix this by adding the implied seals before the call for mappingdenywritable() is done.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63952.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

c4f75bc8bd6b3d62665e1f5400c419540edb5601

Fixed

b3f4f82d1315f1439059a83d1c22c51a5b43d99e

Fixed

3be2a24f7f72ad7321ed6ad1715b956a4527bcf4

Fixed

0995d1f79aed8ccbf62056189dd53fd19726ea08

Fixed

555702282d4536a865dfffb1cd4f6028f196e7e8

Fixed

3b041514cb6eae45869b020f743c14d983363222

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-63952.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.3.0

Fixed

6.6.143

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.93

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.35

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.0.12

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-63952.json"