UBUNTU-CVE-2026-99177: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate() setpagedirty() requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from getuserpagesfast(), so use setpagedirtylock(). [sean: tag for stable]
Affected Software
Event History
Frequently Asked Questions
Which systems are in scope?
The affected software list includes Ubuntu linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-aws-5.0, and linux-aws-5.3 kernel packages.
What condition is involved in exploitation?
The issue is in KVM SEV handling during sev_gmem_post_populate(), where a page obtained through get_user_pages_fast() is dirtied without the locking required to prevent its mapping from concurrently disappearing.
What is the remediation indicated by the fix?
The resolved fix replaces set_page_dirty() with set_page_dirty_lock() in the affected KVM SEV code path, providing the necessary protection while dirtying the page.