All vulnerabilities
CVE-2026-99177

Linux: KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in184382f9852d433af21de96c334ecf43b8414ed8Also 97818b2fa7082e940ddd36dab12a68615300e798CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 184382f9852d433af21de96c334ecf43b8414ed8LinuxCVE List
  • 97818b2fa7082e940ddd36dab12a68615300e798LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

set_page_dirty() requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from get_user_pages_fast(), so use set_page_dirty_lock().

[sean: tag for stable]

Text from CVE List

Affected versions 6

  • Linuxaffected: 97cd21d57e9bd2da79845178d9250cfd19289cd4 before 184382f9852d433af21de96c334ecf43b8414ed8CVE List
  • Linuxaffected: 97cd21d57e9bd2da79845178d9250cfd19289cd4 before 97818b2fa7082e940ddd36dab12a68615300e798CVE List
  • Linuxaffected: 7.2CVE List
  • Linuxunaffected: all versions before 7.2CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2