{"cve":"CVE-2026-63952","nvd":{"published":"2026-07-19T16:17:13.950","modified":"2026-10-19T21:17:14.160","status":"Undergoing Analysis","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmemfd: deny writeable mappings when implying SEAL_WRITE\n\nWhen SEAL_EXEC is added, SEAL_WRITE is implied to make W^X.  But the\nimplied seal is set after the check that makes sure the memfd can not have\nany writable mappings.  This means one can use SEAL_EXEC to apply\nSEAL_WRITE while having writeable mappings.\n\nThis breaks the contract that SEAL_WRITE provides and can be used by an\nattacker to pass a memfd that appears to be write sealed but can still be\nmodified arbitrarily.\n\nFix this by adding the implied seals before the call for\nmapping_deny_writable() is done.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","score":8.4},"cwes":["CWE-362"],"references":["https://git.kernel.org/stable/c/0995d1f79aed8ccbf62056189dd53fd19726ea08","https://git.kernel.org/stable/c/3b041514cb6eae45869b020f743c14d983363222","https://git.kernel.org/stable/c/3be2a24f7f72ad7321ed6ad1715b956a4527bcf4","https://git.kernel.org/stable/c/555702282d4536a865dfffb1cd4f6028f196e7e8","https://git.kernel.org/stable/c/b3f4f82d1315f1439059a83d1c22c51a5b43d99e"],"products":[],"source":"nvd","synced_at":"2026-10-21T03:43:09.190223697+00:00"},"epss":{"cve":"CVE-2026-63952","score":0.00127,"percentile":0.02386,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}