diff --git a/packages/orchestrator/internal/sandbox/uffd/userfaultfd/page_tracker.go b/packages/orchestrator/internal/sandbox/uffd/userfaultfd/page_tracker.go
--- a/packages/orchestrator/internal/sandbox/uffd/userfaultfd/page_tracker.go
+++ b/packages/orchestrator/internal/sandbox/uffd/userfaultfd/page_tracker.go
@@ -13,27 +13,35 @@
 type pageTracker struct {
 	pageSize uintptr
 
-	m  map[uintptr]pageState
-	mu sync.RWMutex
+	m        map[uintptr]pageState
+	versions map[uintptr]uint64
+	mu       sync.RWMutex
 }
 
 func newPageTracker(pageSize uintptr) pageTracker {
 	return pageTracker{
 		pageSize: pageSize,
 		m:        make(map[uintptr]pageState),
+		versions: make(map[uintptr]uint64),
 	}
 }
 
 func (pt *pageTracker) get(addr uintptr) pageState {
+	state, _ := pt.getWithVersion(addr)
+
+	return state
+}
+
+func (pt *pageTracker) getWithVersion(addr uintptr) (pageState, uint64) {
 	pt.mu.RLock()
 	defer pt.mu.RUnlock()
 
 	state, ok := pt.m[addr]
 	if !ok {
-		return unfaulted
+		return unfaulted, pt.versions[addr]
 	}
 
-	return state
+	return state, pt.versions[addr]
 }
 
 func (pt *pageTracker) setState(start, end uintptr, state pageState) {
@@ -42,5 +50,20 @@
 
 	for addr := start; addr < end; addr += pt.pageSize {
 		pt.m[addr] = state
+		pt.versions[addr]++
 	}
 }
+
+func (pt *pageTracker) setStateIfVersion(addr uintptr, state pageState, version uint64) bool {
+	pt.mu.Lock()
+	defer pt.mu.Unlock()
+
+	if pt.versions[addr] != version {
+		return false
+	}
+
+	pt.m[addr] = state
+	pt.versions[addr]++
+
+	return true
+}

diff --git a/packages/orchestrator/internal/sandbox/uffd/userfaultfd/prefault.go b/packages/orchestrator/internal/sandbox/uffd/userfaultfd/prefault.go
--- a/packages/orchestrator/internal/sandbox/uffd/userfaultfd/prefault.go
+++ b/packages/orchestrator/internal/sandbox/uffd/userfaultfd/prefault.go
@@ -23,6 +23,8 @@
 		return fmt.Errorf("data length (%d) does not match pagesize (%d)", len(data), u.pageSize)
 	}
 
+	_, version := u.pageTracker.getWithVersion(addr)
+
 	// We're treating prefault handling as if it was caused by a read access.
 	// This way, we will fault the page with UFFD_COPY_MODE_WP which will preserve
 	// the WP bit for the page. This works even in the case of a race with a
@@ -33,6 +35,9 @@
 	//
 	// In both cases, the WP bit will be cleared because it is handled asynchronously
 	// by the kernel.
+	u.settleRequests.RLock()
+	defer u.settleRequests.RUnlock()
+
 	handled, err := u.faultPage(
 		ctx,
 		addr,
@@ -49,8 +54,13 @@
 
 	if !handled {
 		span.AddEvent("prefault: page already faulted or write returned EAGAIN")
+
+		return nil
 	}
 
+	u.pageTracker.setStateIfVersion(addr, faulted, version)
+	u.prefetchTracker.Add(offset, block.Read)
+
 	return nil
 }
 

diff --git a/packages/orchestrator/internal/sandbox/uffd/userfaultfd/userfaultfd.go b/packages/orchestrator/internal/sandbox/uffd/userfaultfd/userfaultfd.go
--- a/packages/orchestrator/internal/sandbox/uffd/userfaultfd/userfaultfd.go
+++ b/packages/orchestrator/internal/sandbox/uffd/userfaultfd/userfaultfd.go
@@ -276,7 +276,8 @@
 
 			var source block.Slicer
 
-			switch state := u.pageTracker.get(addr); state {
+			state, version := u.pageTracker.getWithVersion(addr)
+			switch state {
 			case faulted:
 				// Skip faulting the page. This has already been faulted, either during pre-faulting
 				// or because we handled another page fault on the same address in the current
@@ -319,7 +320,7 @@
 				}
 
 				if handled {
-					u.pageTracker.setState(addr, addr+u.pageSize, faulted)
+					u.pageTracker.setStateIfVersion(addr, faulted, version)
 					u.prefetchTracker.Add(offset, accessType)
 				} else {
 					deferred.push(pf)