Unscored severity · published Oct 28, 2026
CVE-2026-99177
KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
New
–
CVSS
–
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
set_page_dirty() requires that the caller holds some kind of lock to
ensure that the page's mapping does not concurrently go away.
That is not the case for a random page we got from get_user_pages_fast(),
so use set_page_dirty_lock().
[sean: tag for stable]
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Linux
97cd21d57e9bd2da79845178d9250cfd19289cd4 before 184382f9852d433af21de96c334ecf43b8414ed8; 97cd21d57e9bd2da79845178d9250cfd19289cd4 before 97818b2fa7082e940ddd36dab12a68615300e798; 7.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-99177
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-99177
git.kernel.org
https://git.kernel.org/stable/c/184382f9852d433af21de96c334ecf43b8414ed8
git.kernel.org
https://git.kernel.org/stable/c/97818b2fa7082e940ddd36dab12a68615300e798
More from Linux
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
7.8
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
7.8
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place