CVE-2026-63952

A flaw was found in the Linux kernel's memfd component. When the SEAL_EXEC flag is used to create a memory file descriptor, the SEAL_WRITE flag is implicitly applied to prevent writing to executable memory. However, this implicit write protection is applied after checks that should deny writable mappings, allowing an attacker to maintain writable access to a memfd that appears to be write-sealed. This vulnerability could allow a local attacker to arbitrarily modify memory, potentially leading to privilege escalation or other impacts.

An IMPORTANT-severity flaw was found in the Linux kernel's memfd memory-sealing mechanism, affecting the kernel and kernel-rt components in Red Hat Enterprise Linux 9 and 10 and the kernel, kernel-rt, and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2.0 and 2.1, where fixes are being pursued. When the SEAL_EXEC seal is added to a memory file descriptor (memfd), the kernel implicitly applies SEAL_WRITE to enforce write-execute (W^X) protection. However, the implied seal was applied after the check that denies writable mappings, so a local attacker could add SEAL_EXEC to a memfd that still holds a writable mapping. The resulting memfd appears write-sealed but can still be modified arbitrarily through the retained writable mapping, breaking the security contract that SEAL_WRITE provides and potentially allowing the attacker to escalate privileges or cause other impacts. Red Hat Enterprise Linux 6, 7, and 8, as well as the RHEL 9.2 and 9.4 update streams, are not affected because the vulnerable code is not present in those releases. Red Hat assesses this flaw as CVSS 7.0 IMPORTANT (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), which is lower than the 8.4 score in the upstream CVE record, reflecting Red Hat's evaluation of higher attack complexity and unchanged scope for exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.