diff --git a/hw/xwayland/xwayland-shm.c b/hw/xwayland/xwayland-shm.c
index 00f2600a7..612fe8263 100644
--- a/hw/xwayland/xwayland-shm.c
+++ b/hw/xwayland/xwayland-shm.c
@@ -114,6 +114,13 @@ create_tmpfile_cloexec(char *tmpname)
  * given size. If disk space is insufficient, errno is set to ENOSPC.
  * If posix_fallocate() is not supported, program may receive
  * SIGBUS on accessing mmap()'ed file contents instead.
+ *
+ * If the C library implements memfd_create(), it is used to create the
+ * file purely in memory, without any backing file name on the file
+ * system, and then sealing off the possibility of shrinking it.  This
+ * can then be checked before accessing mmap()'ed file contents, to
+ * make sure SIGBUS can't happen.  It also avoids requiring
+ * XDG_RUNTIME_DIR.
  */
 static int
 os_create_anonymous_file(off_t size)
@@ -124,26 +131,40 @@ os_create_anonymous_file(off_t size)
     int fd;
     int ret;
 
-    path = getenv("XDG_RUNTIME_DIR");
-    if (!path) {
-        errno = ENOENT;
-        return -1;
+#ifdef HAVE_MEMFD_CREATE
+    fd = memfd_create("xwayland-shared", MFD_CLOEXEC | MFD_ALLOW_SEALING);
+    if (fd >= 0) {
+        /* We can add this seal before calling posix_fallocate(), as
+         * the file is currently zero-sized anyway.
+         *
+         * There is also no need to check for the return value, we
+         * couldn't do anything with it anyway.
+         */
+        fcntl(fd, F_ADD_SEALS, F_SEAL_SHRINK);
+    } else
+#endif
+    {
+        path = getenv("XDG_RUNTIME_DIR");
+        if (!path) {
+            errno = ENOENT;
+            return -1;
+        }
+
+        name = malloc(strlen(path) + sizeof(template));
+        if (!name)
+            return -1;
+
+        strcpy(name, path);
+        strcat(name, template);
+
+        fd = create_tmpfile_cloexec(name);
+
+        free(name);
+
+        if (fd < 0)
+            return -1;
     }
 
-    name = malloc(strlen(path) + sizeof(template));
-    if (!name)
-        return -1;
-
-    strcpy(name, path);
-    strcat(name, template);
-
-    fd = create_tmpfile_cloexec(name);
-
-    free(name);
-
-    if (fd < 0)
-        return -1;
-
 #ifdef HAVE_POSIX_FALLOCATE
     /*
      * posix_fallocate does an explicit rollback if it gets EINTR.