diff --git a/mm/memory.c b/mm/memory.c
index c4a183d27e45..04906d1d7be7 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4461,7 +4461,7 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
 	if (unlikely((vma_is_anonymous(vmf.vma) && !vmf.vma->anon_vma) ||
 		(!vma_is_anonymous(vmf.vma) &&
 			!(vmf.vma->vm_flags & VM_SHARED) &&
-			(flags & FAULT_FLAG_WRITE) &&
+			(vmf.flags & FAULT_FLAG_WRITE) &&
 			!vmf.vma->anon_vma)))
 		return VM_FAULT_RETRY;