diff --git a/src/system/kernel/vm/vm.cpp b/src/system/kernel/vm/vm.cpp
index 5c1b324808..d1f941a656 100644
--- a/src/system/kernel/vm/vm.cpp
+++ b/src/system/kernel/vm/vm.cpp
@@ -3700,6 +3700,10 @@ vm_page_fault(addr_t address, addr_t faultAddress, bool isWrite, bool isUser,
 			vm_area *area;
 
 			acquire_sem_etc(addressSpace->sem, READ_COUNT, 0, 0);
+// TODO: The user_memcpy() below can cause a deadlock, if it causes a page
+// fault and someone is already waiting for a write lock on the same address
+// space. This thread will then try to acquire the semaphore again and will
+// be queued after the writer.
 			area = vm_area_lookup(addressSpace, faultAddress);
 
 			dprintf("vm_page_fault: sending team \"%s\" 0x%lx SIGSEGV, ip %#lx (\"%s\" +%#lx)\n",