Riskcovery

CVE-2026-98821

block: reject polled dio with user integrity metadata

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

block: reject polled dio with user integrity metadata

IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses __blkdev_direct_IO(), which never publishes the bio for polling, so IOPOLL calls bio_poll() on the uio_meta.

Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device (scsi_debug dif=1 dix=1). KASAN reports:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bio_poll+0x9d/0x4b0 Call Trace: iocb_bio_iopoll+0x5b/0x80 io_uring_classic_poll+0xf3/0x140 io_do_iopoll+0x4e3/0xc00 io_iopoll_check+0x275/0x560 __do_sys_io_uring_enter+0x2e5/0x720

Return -EOPNOTSUPP when HIPRI is combined with user metadata.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 2729a60bbfb9215997f25372ebe9b7964f038296 to before c97ef13ad96be0e08af38dfa2ed40cded0b53e1bAffected
  • 2729a60bbfb9215997f25372ebe9b7964f038296 to before dd33c03cefccdfcb223e9e6262643d64f8c1ae20Affected
  • 2729a60bbfb9215997f25372ebe9b7964f038296 to before 2a42e6fe1293f2e2d579c9fe5bbab056dd8b880eAffected
  • 17ecefc9fdd8c554e0d03e5a990daef19f930addAffected
  • 6.16.8 to before 6.17Affected
LinuxLinux
  • 6.17Affected
  • before 6.17Not affected
  • 6.18.56 through 6.18.*Not affected
  • 7.2.10 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.