CVE-2026-99177: KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Fix page dirtying in sevgmempostpopulate()

setpagedirty() requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from getuserpagesfast(), so use setpagedirtylock().

[sean: tag for stable]

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 28, 2026

CVE Published

via MITRE·10:35 AM

Data Sourced

via MITRE·10:35 AM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

The issue is in the Linux kernel's KVM SEV code path, specifically sev_gmem_post_populate(). Systems that do not use this KVM SEV functionality are not indicated by the provided data as being exposed.

What condition triggers the flaw?

The issue occurs when sev_gmem_post_populate() dirties a page obtained through get_user_pages_fast() using set_page_dirty() without a lock that prevents the page mapping from being concurrently removed.

What is the remediation?

Apply a Linux kernel update containing the fix, which changes the page-dirtying operation to use set_page_dirty_lock(). The provided references identify stable kernel commits for the remediation.

CVE-2026-99177: KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What condition triggers the flaw?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What condition triggers the flaw?

What is the remediation?