diff --git a/pkgs/os-specific/linux/kernel/ecryptfs-fix-mmap-bug.patch b/pkgs/os-specific/linux/kernel/ecryptfs-fix-mmap-bug.patch
new file mode 100644
index 000000000000..7f94669a9f45
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/ecryptfs-fix-mmap-bug.patch
@@ -0,0 +1,20 @@
+Signed-off-by: Tyler Hicks <tyhicks@xxxxxxxxxxxxx>
+Tested-by: Tyler Hicks <tyhicks@xxxxxxxxxxxxx> # 4.4.y, 3.18.y
+Cc: <stable@xxxxxxxxxxxxxxx> # 4.5-
+---
+ fs/ecryptfs/kthread.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
+index e818f5a..b9faeab 100644
+--- a/fs/ecryptfs/kthread.c
++++ b/fs/ecryptfs/kthread.c
+@@ -171,7 +171,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
+ 		goto out;
+ 	}
+ have_file:
+-	if ((*lower_file)->f_op->mmap == NULL) {
++	if ((*lower_file)->f_op->mmap == NULL && !d_is_dir(lower_dentry)) {
+ 		fput(*lower_file);
+ 		*lower_file = NULL;
+ 		rc = -EMEDIUMTYPE;
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 4f8d57acc17b..7b2feaf84a80 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -148,4 +148,8 @@ rec {
         sha256 = "14rm1qr87p7a5prz8g5fwbpxzdp3ighj095x8rvhm8csm20wspyy";
       };
     };
+  ecryptfs_fix_mmap_bug =
+    { name = "ecryptfs_fix_mmap_bug";
+      patch = ./ecryptfs-fix-mmap-bug.patch;
+    };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4d40567f262e..e982c9c4ee7a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10954,6 +10954,7 @@ in
       [ kernelPatches.bridge_stp_helper
         kernelPatches.qat_common_Makefile
         kernelPatches.hiddev_CVE_2016_5829
+        kernelPatches.ecryptfs_fix_mmap_bug
       ]
       ++ lib.optionals ((platform.kernelArch or null) == "mips")
       [ kernelPatches.mips_fpureg_emu