memfd-create · shipping · also memfd, memfd_create()

Linux memfd_create

Linux memfd_create() creates an anonymous volatile file and returns a descriptor for file operations and memory mapping.

Related Observatory article: Linux memfd_create on hesela.com

Lifetime: the name is a diagnostic label, not a pathname or unique identity. The object survives while references remain, including mappings after the original descriptor closes. [1]

Sharing: a descriptor can be passed to another process. File seals constrain operations on the underlying object when sealing is enabled. Explicit MFD_ALLOW_SEALING avoids relying on the default seal set. MFD_NOEXEC_SEAL explicitly creates a non-executable object and implies MFD_ALLOW_SEALING; its initial F_SEAL_EXEC prevents changing execute bits. Creation defaults depend on kernel execution policy. [2] [3]

Backing: the ordinary implementation uses shmem rather than a persistent filesystem file. Volatile does not mean that every page stays in physical RAM, since tmpfs can use swap. [2] [4]

Relations

related

file-sealing, memory-mapped-file, open-file-description, copy-on-write

Advantages

• A descriptor can identify a shared buffer without a named temporary-file lifecycle.

Limitations

• Creation may be restricted by kernel configuration, system policy or sandbox rules.

Citations

1. Linux man-pages: memfd_create(2) (accessed 2026-10-17)
2. Linux v6.12: memfd sealing implementation (accessed 2026-10-17)
3. Linux kernel: non-executable memfd policy (accessed 2026-10-17)
4. Linux kernel: tmpfs and swap (accessed 2026-10-17)

JSON: /data/terms/memfd-create.json