{"id":"CVE-2026-98821","title":"block: reject polled dio with user integrity metadata","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: reject polled dio with user integrity metadata\n\nIOCB_HAS_METADATA leaves iocb->private as a uio_meta, while\niocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 2729a60bbfb9215997f25372ebe9b7964f038296 < c97ef13ad96be0e08af38dfa2ed40cded0b53e1b","Linux >= 2729a60bbfb9215997f25372ebe9b7964f038296 < dd33c03cefccdfcb223e9e6262643d64f8c1ae20","Linux >= 2729a60bbfb9215997f25372ebe9b7964f038296 < 2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e","Linux 17ecefc9fdd8c554e0d03e5a990daef19f930add","Linux >= 6.16.8 < 6.17","Linux 6.17"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:49:13.154Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98821","references":[{"url":"https://git.kernel.org/stable/c/c97ef13ad96be0e08af38dfa2ed40cded0b53e1b"},{"url":"https://git.kernel.org/stable/c/dd33c03cefccdfcb223e9e6262643d64f8c1ae20"},{"url":"https://git.kernel.org/stable/c/2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T16:47:32.474Z","slug":"CVE-2026-98821","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblock: reject polled dio with user integrity metadata\n\nIOCB_HAS_METADATA leaves iocb->private as a uio_meta, while\niocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O\nalways uses __blkdev_direct_IO(), which never publishes the bio for\npolling, so IOPOLL calls bio_poll() on the uio_meta.\n\nReproducer: io_uring IOPOLL plus a PI attribute on an integrity device\n(scsi_debug dif=1 dix=1). KASAN reports:\n\n  Oops: general protection fault, probably for non-canonical\n  address 0xdffffc0000000004\n  KASAN: null-ptr-deref in range\n  [0x0000000000000020-0x0000000000000027]\n  RIP: 0010:bio_poll+0x9d/0x4b0\n  Call Trace:\n   iocb_bio_iopoll+0x5b/0x80\n   io_uring_classic_poll+0xf3/0x140\n   io_do_iopoll+0x4e3/0xc00\n   io_iopoll_check+0x275/0x560\n   __do_sys_io_uring_enter+0x2e5/0x720\n\nReturn -EOPNOTSUPP when HIPRI is combined with user metadata.\n\n## Affected\n\n- `Linux >= 2729a60bbfb9215997f25372ebe9b7964f038296 < c97ef13ad96be0e08af38dfa2ed40cded0b53e1b`\n- `Linux >= 2729a60bbfb9215997f25372ebe9b7964f038296 < dd33c03cefccdfcb223e9e6262643d64f8c1ae20`\n- `Linux >= 2729a60bbfb9215997f25372ebe9b7964f038296 < 2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e`\n- `Linux 17ecefc9fdd8c554e0d03e5a990daef19f930add`\n- `Linux >= 6.16.8 < 6.17`\n- `Linux 6.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}