{"id":"CVE-2026-99177","kind":"vulnerability","aliases":["CVE-2026-99177"],"related":[],"title":"Linux kernel KVM SEV: page dirtying without a lock during guest populate","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Fix page dirtying in sev_gmem_post_populate()\n\nset_page_dirty() requires that the caller holds some kind of lock to\nensure that the page's mapping does not concurrently go away.\nThat is not the case for a random page we got from get_user_pages_fast(),\nso use set_page_dirty_lock().\n\n[sean: tag for stable]","summary":"In the Linux kernel's KVM SEV code, a page is marked dirty without holding the lock that keeps its mapping from disappearing, which can corrupt memory state. The sources do not say what an attacker can gain from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd-sev","infrastructure","kvm","linux-kernel","self-hosted"],"not_affected_if":["no-amd-sev-guests"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the NVD entry\n- Check whether KVM SEV guests are in use: `ls /dev/sev` on AMD EPYC hosts running KVM","fix":"- Update the Linux kernel to a stable release that includes the upstream commit for this fix (version numbers unknown from the sources)","status":"open","published_at":"2026-10-28T11:17:38+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:29+00:00","updated_at":"2026-10-28T11:35:29+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-28T11:35:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes the upstream commit for this fix (version numbers unknown from the sources)","reach":"local","title":"Linux kernel KVM SEV: page dirtying without a lock during guest populate","impact":"medium","summary":"In the Linux kernel's KVM SEV code, a page is marked dirty without holding the lock that keeps its mapping from disappearing, which can corrupt memory state. The sources do not say what an attacker can gain from it.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","kvm","amd-sev","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; memory corruption in the host kernel is possible","analyst_note":"Check the NVD entry and the upstream stable commit for the impact and fixed kernel versions.","how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the NVD entry\n- Check whether KVM SEV guests are in use: `ls /dev/sev` on AMD EPYC hosts running KVM","needs_analyst":true,"not_affected_if":["no-amd-sev-guests"],"who_is_affected":"Only hosts running the Linux kernel KVM module with AMD SEV guests, using guest memory from userspace, are in scope. Hosts without AMD SEV-enabled KVM guests can likely skip it, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000605,"input_tokens":3357,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99177':15A,18A 'amd':20B 'amd-sev':19B 'attack':65B 'away':111C 'caller':94C 'case':116C 'code':37B 'concurr':109C 'corrupt':55B 'cve':13A,16A 'dirti':6A,42B,82C,90C,132C 'disappear':52B 'ensur':101C 'fast':127C 'fix':80C 'follow':73C 'gain':67B 'get':124C 'gmem':85C 'go':110C 'got':122C 'guest':11A 'hold':44B,95C 'host':29B 'infrastructur':22B 'keep':48B 'kernel':2A,26B,33B,71C 'kind':97C 'kvm':3A,23B,35B,78C 'linux':1A,25B,32B,70C 'linux-kernel':24B 'lock':9A,46B,99C,133C 'map':50B,106C 'mark':41B 'memori':56B 'page':5A,39B,81C,89C,104C,120C,126C,131C 'popul':12A,87C 'post':86C 'random':119C 'requir':91C 'resolv':77C 'say':62B 'sean':134C 'self':28B 'self-host':27B 'set':88C,130C 'sev':4A,21B,36B,79C,84C 'sourc':59B 'stabl':137C 'state':57B 'tag':135C 'use':129C 'user':125C 'vulner':74C 'without':7A,43B","nicknames":[],"mitigations":[],"who_affected":"Only hosts running the Linux kernel KVM module with AMD SEV guests, using guest memory from userspace, are in scope. Hosts without AMD SEV-enabled KVM guests can likely skip it, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99177","severity":null,"published_at":"2026-10-28T11:17:38+00:00","modified_at":"2026-10-28T11:17:38+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}