diff --git a/mm/memory.c b/mm/memory.c
index 2fc4a2e04e0d..3c6d065b93fb 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3505,6 +3505,17 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
 				lru_cache_add(page);
 				swap_readpage(page, true);
 			}
+		} else if (vmf->flags & FAULT_FLAG_SPECULATIVE) {
+			/*
+			 * Don't try readahead during a speculative page fault
+			 * as the VMA's boundaries may change in our back.
+			 * If the page is not in the swap cache and synchronous
+			 * read is disabled, fall back to the regular page fault
+			 * mechanism.
+			 */
+			delayacct_clear_flag(DELAYACCT_PF_SWAPIN);
+			ret = VM_FAULT_RETRY;
+			goto out;
 		} else {
 			page = swapin_readahead(entry, GFP_HIGHUSER_MOVABLE,
 						vmf);