CVE-2026-98821block: reject polled dio with user integrity metadata
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses __blkdev_direct_IO(), which never publishes the bio for polling, so IOPOLL calls bio_poll() on the uio_meta. Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device (scsi_debug dif=1 dix=1). KASAN reports: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bio_poll+0x9d/0x4b0 Call Trace: iocb_bio_iopoll+0x5b/0x80 io_uring_classic_poll+0xf3/0x140 io_do_iopoll+0x4e3/0xc00 io_iopoll_check+0x275/0x560 __do_sys_io_uring_enter+0x2e5/0x720 Return -EOPNOTSUPP when HIPRI is combined with user metadata.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2729a60bbfb9215997f25372ebe9b7964f038296 before c97ef13ad96be0e08af38dfa2ed40cded0b53e1b; from 2729a60bbfb9215997f25372ebe9b7964f038296 before dd33c03cefccdfcb223e9e6262643d64f8c1ae20; 2729a60bbfb9215997f25372ebe9b7964f038296 builds before 2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e; 17ecefc9fdd8c554e0d03e5a990daef19f930add; from 6.16.8 before 6.17 | CNA record |
References
- https://git.kernel.org/stable/c/c97ef13ad96be0e08af38dfa2ed40cded0b53e1b
- https://git.kernel.org/stable/c/dd33c03cefccdfcb223e9e6262643d64f8c1ae20
- https://git.kernel.org/stable/c/2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.