---
id: "CVE-2026-99177"
kind: "vulnerability"
aliases: ["CVE-2026-99177"]
title: "Linux kernel KVM SEV: page dirtying without a lock during guest populate"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["amd-sev", "infrastructure", "kvm", "linux-kernel", "self-hosted"]
not_affected_if: ["no-amd-sev-guests"]
published_at: "2026-10-28T11:17:38+00:00"
first_seen_at: "2026-10-28T11:32:36+00:00"
updated_at: "2026-10-28T11:35:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99177", "first_seen_at": "2026-10-28T11:32:36+00:00"}]
---

# Linux kernel KVM SEV: page dirtying without a lock during guest populate

In the Linux kernel's KVM SEV code, a page is marked dirty without holding the lock that keeps its mapping from disappearing, which can corrupt memory state. The sources do not say what an attacker can gain from it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the fixed kernel builds listed in the NVD entry
- Check whether KVM SEV guests are in use: `ls /dev/sev` on AMD EPYC hosts running KVM

## Fix

- Update the Linux kernel to a stable release that includes the upstream commit for this fix (version numbers unknown from the sources)

## Timeline

- 2026-10-28T11:32:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99177

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

set_page_dirty() requires that the caller holds some kind of lock to
ensure that the page's mapping does not concurrently go away.
That is not the case for a random page we got from get_user_pages_fast(),
so use set_page_dirty_lock().

[sean: tag for stable]

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_