In the Linux kernel memfd, when SEAL_EXEC is added, SEAL_WRITE is implied to enforce W^X, but the implied seal is applied after the check that ensures no writable mappings are allowed. This ordering allows a memfd that appears write‑sealed to still have writable mappings, thereby violating the contract of SEAL_WRITE and permitting an attacker to modify the contents of a supposedly write‑sealed memory file.

Linux kernel builds that have not incorporated the recent patch can be impacted, including kernels from 7.1-rc1 through 7.1-rc5 and all earlier releases.

The CVSS score of 8.4 classifies the vulnerability as high severity and the EPSS score of less than 1% indicates a low probability of immediate public exploitation. It is not listed in the CISA KEV catalog. Based only on the description, the flaw could be exploited by a local process that can create a memfd and set SEAL_EXEC, enabling arbitrary modification of otherwise write‑sealed memory and potentially leading to privilege escalation or other local exploits.