Executive brief
A vulnerability in the Linux kernel's memory management system could allow an attacker to bypass security protections designed to prevent unauthorized modification of executable memory. By exploiting a flaw in how memory 'seals' are applied, a malicious user could maintain write access to a memory region even after it has been marked as read-only and executable. This could potentially lead to unauthorized code execution or system compromise by allowing an attacker to modify trusted data or code in memory.
Technical details
A logic error in the Linux kernel's memfd_add_seals function in mm/memfd.c allows for a bypass of write-sealing contracts. When the SEAL_EXEC flag is applied to a memfd, the kernel implicitly applies SEAL_WRITE to enforce W^X (Write XOR Execute) security principles. However, the kernel was applying this implicit seal after performing the check (mapping_deny_writable) that ensures no writable mappings exist. An attacker can exploit this race or ordering issue to apply SEAL_EXEC while maintaining existing writable mappings, effectively allowing them to modify memory that is supposedly sealed against writes. This vulnerability affects Linux kernel versions from 6.3 up to 7.1 and has been patched in various stable branches (6.6.143+, 6.12.93+, 6.18.35+, 7.0.12+).
Affected products
- Linux Linux 6.3 to 7.1
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/0995d1f79aed8ccbf62056189dd53fd19726ea08
- https://git.kernel.org/stable/c/3b041514cb6eae45869b020f743c14d983363222
- https://git.kernel.org/stable/c/3be2a24f7f72ad7321ed6ad1715b956a4527bcf4
- https://git.kernel.org/stable/c/555702282d4536a865dfffb1cd4f6028f196e7e8
- https://git.kernel.org/stable/c/b3f4f82d1315f1439059a83d1c22c51a5b43d99e