diff --git a/docs/users.rst b/docs/users.rst
index 32a6ba9e..7842ff78 100644
--- a/docs/users.rst
+++ b/docs/users.rst
@@ -214,3 +214,9 @@ Limitations
     ::
 
        sudo systemctl restart xos_hwb
+
+31. System calls can write the mcexec VMAs with PROT_WRITE flag not
+    set. This is because we never turn off PROT_WRITE of the mcexec
+    VMAs to circumvent the issue "set_host_vma(): do NOT read protect
+    Linux VMA".
+