← CVE announcements

SECURITY ANNOUNCEMENT

CVE-2026-99177

28 October 2026

set_page_dirty() requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from get_user_pages_fast(), so use set_page_dirty_lock().

[sean: tag for stable]

Introduced

7.2 97cd21d57e9bd2da79845178d9250cfd19289cd4

Fixed releases

7.2.13 184382f9852d433af21de96c334ecf43b8414ed8

7.3 97818b2fa7082e940ddd36dab12a68615300e798

View source announcement ↗