All vulnerabilities
CVE-2026-98821

Linux: block: reject polled dio with user integrity metadata

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2a42e6fe1293f2e2d579c9fe5bbab056dd8b880eAlso 6.17CVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

block: reject polled dio with user integrity metadata

IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses __blkdev_direct_IO(), which never publishes the bio for polling, so IOPOLL calls bio_poll() on the uio_meta.

Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device (scsi_debug dif=1 dix=1). KASAN reports:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bio_poll+0x9d/0x4b0 Call Trace: iocb_bio_iopoll+0x5b/0x80 io_uring_classic_poll+0xf3/0x140 io_do_iopoll+0x4e3/0xc00 io_iopoll_check+0x275/0x560 __do_sys_io_uring_enter+0x2e5/0x720

Return -EOPNOTSUPP when HIPRI is combined with user metadata.

Text from CVE List

Affected versions 10

  • Linuxaffected: 2729a60bbfb9215997f25372ebe9b7964f038296 before c97ef13ad96be0e08af38dfa2ed40cded0b53e1bCVE List
  • Linuxaffected: 2729a60bbfb9215997f25372ebe9b7964f038296 before dd33c03cefccdfcb223e9e6262643d64f8c1ae20CVE List
  • Linuxaffected: 2729a60bbfb9215997f25372ebe9b7964f038296 before 2a42e6fe1293f2e2d579c9fe5bbab056dd8b880eCVE List
  • Linuxaffected: 17ecefc9fdd8c554e0d03e5a990daef19f930addCVE List
  • Linuxaffected: 6.16.8 before 6.17CVE List
  • Linuxaffected: 6.17CVE List
  • Linuxunaffected: all versions before 6.17CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3