Skip to main content

Linux Kernel EUVDEUVD-2026-45725

| CVE-2026-63952 HIGH
2026-07-19 Linux GHSA-6pc4-h32v-99rg
Information Disclosure Linux
8.4
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
vuln.today AI
6.5 MEDIUM

Local unprivileged process (AV:L/PR:L) bypasses a seal to mutate data a separate trusting consumer relies on (S:C, I:H); no direct read (C:N) or availability (A:N) impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:32 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.4 (HIGH)
Patch available
Jul 19, 2026 - 17:19 EUVD
CVE Published
Jul 19, 2026 - 14:55 cve.org
HIGH 8.4
CVE Published
Jul 19, 2026 - 14:55 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

memfd: deny writeable mappings when implying SEAL_WRITE

When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means one can use SEAL_EXEC to apply SEAL_WRITE while having writeable mappings.

This breaks the contract that SEAL_WRITE provides and can be used by an attacker to pass a memfd that appears to be write sealed but can still be modified arbitrarily.

Fix this by adding the implied seals before the call for mapping_deny_writable() is done.

AnalysisAI

Protection-mechanism bypass in the Linux kernel's memfd file-sealing subsystem lets a local low-privileged process hold writable mappings on a memfd while still applying SEAL_WRITE via the SEAL_EXEC path, defeating the immutability guarantee that consumers rely on. Because the implied SEAL_WRITE was set after the mapping_deny_writable() check rather than before, an attacker can hand a victim (e.g. a sandbox or loader) a memfd that reports as write-sealed yet remains arbitrarily modifiable. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is not on CISA KEV.

Technical ContextAI

memfd_create() with file sealing (F_ADD_SEALS) lets a process pin the state of an anonymous memory file so other processes can trust its contents. SEAL_WRITE forbids any further writes and is only accepted when no writable mappings exist, enforced by mapping_deny_writable(). SEAL_EXEC was introduced to build W^X (write-xor-execute) semantics and implies SEAL_WRITE. The defect is an ordering bug: the implied SEAL_WRITE bit was OR-ed into the seal set only after the writable-mapping check had already passed, so a memfd that still had live writable mappings could nonetheless acquire SEAL_WRITE. This is a protection-mechanism enforcement failure (closest CWE class: CWE-693 Protection Mechanism Failure, with TOCTOU-like ordering; the input lists CWE as N/A). The fix reorders the code so implied seals are applied before mapping_deny_writable() runs, restoring the invariant.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.143, 6.12.93, 6.18.35, or 7.0.12 (or mainline 7.1) - or your distribution's build that backports the corresponding commit (git.kernel.org stable commits b3f4f82d1315, 3be2a24f7f72, 0995d1f79aed, 555702282d45, 3b041514cb6e). Because the fix is a small code-ordering change in the sealing path with no configuration toggle, patching is the correct remediation and there is no clean kernel-level workaround. As a compensating control until patched, restrict the ability of untrusted local processes to create and pass memfds across trust boundaries (e.g. tighten sandbox seccomp/LSM policy so consumers do not treat SEAL_WRITE/SEAL_EXEC as an integrity guarantee, or have the consumer independently re-verify writability), accepting that this adds enforcement overhead and requires application changes. Track advisories via the NVD entry above.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45725 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy