CVE-2026-99177 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
set_page_dirty() requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from get_user_pages_fast(), so use set_page_dirty_lock().
[sean: tag for stable]
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The Linux kernel vulnerability identified in this advisory relates to improper synchronization within the Kernel Virtual Machine (KVM) subsystem, specifically affecting Secure Encrypted Virtualization (SEV). The core issue resides in the sev_gmem_post_populate function, where a page retrieved via get_user_pages_fast is marked as dirty using set_page_dirty. This approach violates kernel memory management protocols because set_page_dirty assumes that the caller already holds an appropriate lock to guarantee the stability of the page mapping during the operation. When this assumption does not hold, concurrent access or unmapping events can occur while the function attempts to update the page state, leading to race conditions and potential data corruption or system instability.
From a technical perspective, the flaw stems from a missing synchronization primitive in the code path handling guest memory population for SEV workloads. The get_user_pages_fast API is designed for high-performance scenarios where locking overhead must be minimized, but it does not provide the same guarantees regarding page mapping persistence as locked variants or functions that acquire locks internally. By invoking set_page_dirty without holding a lock on the page's mapping, the kernel exposes itself to race conditions where the underlying memory structure might change between the time the page is fetched and when its dirty status is updated. This can result in undefined behavior, including potential crashes of the virtual machine or host system if the corrupted state affects critical data structures used by the hypervisor.
The operational impact of this vulnerability includes instability within SEV-enabled virtual machines and potentially broader kernel panics depending on how the race condition manifests during execution. Since SEV is a hardware-assisted security feature that encrypts guest memory, any corruption in the management of these encrypted pages could compromise the integrity of the isolation guarantees provided by the technology. Although this may not directly lead to remote code execution or privilege escalation in all scenarios, it poses significant risks to system reliability and availability. Attackers with local access who can trigger specific workloads involving SEV memory population might exploit this race condition to cause denial-of-service conditions or destabilize the host environment.
To mitigate this risk, the recommended action is to apply the kernel patch that replaces set_page_dirty with set_page_dirty_lock in sev_gmem_post_populate. The locked variant ensures that necessary synchronization primitives are acquired before modifying the page state, thereby preventing concurrent access issues and ensuring thread safety during memory management operations. This fix aligns with standard practices for handling shared data structures in the Linux kernel where multiple execution contexts may interact with the same resources. Administrators should update their systems to include this patch, particularly if they utilize SEV features within KVM environments.
This vulnerability is categorized under CWE-362, which describes concurrent access resulting in a race condition, as it involves improper synchronization when accessing shared memory structures. In terms of attack patterns, while not directly mapping to a specific ATT&CK technique due to its nature as an internal kernel logic error rather than an external exploit vector, the potential for causing system instability aligns with techniques related to resource exhaustion or denial-of-service through exploitation of software vulnerabilities. Maintaining up-to-date kernels is essential to prevent such synchronization flaws from impacting production environments relying on secure virtualization technologies.