Index: kernel/generic/include/ipc/sysipc.h
===================================================================
--- kernel/generic/include/ipc/sysipc.h	(revision 560b81c47c7bd8b84ad01838e371562b523c1123)
+++ kernel/generic/include/ipc/sysipc.h	(revision ae665645563afe74e38e94b59a14e25cf0dd0afe)
@@ -40,5 +40,5 @@
 #include <typedefs.h>
 
-extern int ipc_req_internal(int, ipc_data_t *);
+extern int ipc_req_internal(int, ipc_data_t *, sysarg_t);
 
 extern sysarg_t sys_ipc_call_async_fast(sysarg_t, sysarg_t, sysarg_t,
Index: kernel/generic/src/ipc/ops/pagein.c
===================================================================
--- kernel/generic/src/ipc/ops/pagein.c	(revision 560b81c47c7bd8b84ad01838e371562b523c1123)
+++ kernel/generic/src/ipc/ops/pagein.c	(revision ae665645563afe74e38e94b59a14e25cf0dd0afe)
@@ -46,5 +46,14 @@
 static int answer_preprocess(call_t *answer, ipc_data_t *olddata)
 {
+	/*
+	 * We only do the special handling below if the call was initiated by
+	 * the kernel. Otherwise a malicious task could use this mechanism to
+	 * hold memory frames forever.
+	 */
+	if (!answer->priv)
+		return EOK;
+
 	if (!IPC_GET_RETVAL(answer->data)) {
+
 		pte_t pte;
 		uintptr_t frame;
Index: kernel/generic/src/ipc/sysipc.c
===================================================================
--- kernel/generic/src/ipc/sysipc.c	(revision 560b81c47c7bd8b84ad01838e371562b523c1123)
+++ kernel/generic/src/ipc/sysipc.c	(revision ae665645563afe74e38e94b59a14e25cf0dd0afe)
@@ -265,4 +265,5 @@
  * @param phoneid     Phone handle for the call.
  * @param data[inout] Structure with request/reply data.
+ * @param priv        Value to be stored in call->priv.
  *
  * @return EOK on success.
@@ -270,5 +271,5 @@
  *
  */
-int ipc_req_internal(int phoneid, ipc_data_t *data)
+int ipc_req_internal(int phoneid, ipc_data_t *data, sysarg_t priv)
 {
 	phone_t *phone;
@@ -277,4 +278,5 @@
 	
 	call_t *call = ipc_call_alloc(0);
+	call->priv = priv;
 	memcpy(call->data.args, data->args, sizeof(data->args));
 	
Index: kernel/generic/src/mm/backend_user.c
===================================================================
--- kernel/generic/src/mm/backend_user.c	(revision 560b81c47c7bd8b84ad01838e371562b523c1123)
+++ kernel/generic/src/mm/backend_user.c	(revision ae665645563afe74e38e94b59a14e25cf0dd0afe)
@@ -125,5 +125,5 @@
 	IPC_SET_ARG5(data, pager_info->id3);
 
-	int rc = ipc_req_internal(pager_info->pager, &data);
+	int rc = ipc_req_internal(pager_info->pager, &data, (sysarg_t) true);
 
 	if (rc != EOK) {