CVE-2026-98821 - Vulnerability Details

- block: reject polled dio with user integrity metadata

Description

In the Linux kernel, the following vulnerability has been resolved:

block: reject polled dio with user integrity metadata

IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while
iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O
always uses __blkdev_direct_IO(), which never publishes the bio for
polling, so IOPOLL calls bio_poll() on the uio_meta.

Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device
(scsi_debug dif=1 dix=1). KASAN reports:

Oops: general protection fault, probably for non-canonical
address 0xdffffc0000000004
KASAN: null-ptr-deref in range
[0x0000000000000020-0x0000000000000027]
RIP: 0010:bio_poll+0x9d/0x4b0
Call Trace:
iocb_bio_iopoll+0x5b/0x80
io_uring_classic_poll+0xf3/0x140
io_do_iopoll+0x4e3/0xc00
io_iopoll_check+0x275/0x560
__do_sys_io_uring_enter+0x2e5/0x720

Return -EOPNOTSUPP when HIPRI is combined with user metadata.

Published: 2026-10-18

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability occurs when a Linux kernel io_uring IOPOLL request contains user integrity metadata. The kernel mistakenly treats the metadata pointer as a bio structure during the poll operation, causing a null pointer dereference in the bio_poll routine. This results in a general protection fault and a kernel panic, effectively crashing the system.

Affected Systems

All Linux kernel builds that expose the io_uring IOPOLL interface and support user integrity metadata are affected. The flaw is present in every kernel release prior to the fixes referenced in the provided Git commits; no specific version ranges are listed in the available data.

Risk and Exploitability

The attack vector is local, requiring an attacker to generate an io_uring IOPOLL request with integrity metadata. The CVSS score of 4.7 indicates a moderate severity, and the EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. A successful trigger would cause a kernel panic, effectively denying service until the system is rebooted.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2729a60bbfb9215997f25372ebe9b7964f038296`	affected	< c97ef13ad96be0e08af38dfa2ed40cded0b53e1b
`2729a60bbfb9215997f25372ebe9b7964f038296`	affected	< dd33c03cefccdfcb223e9e6262643d64f8c1ae20
`2729a60bbfb9215997f25372ebe9b7964f038296`	affected	< 2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e
`17ecefc9fdd8c554e0d03e5a990daef19f930add`	affected	—
`6.16.8`	affected	< 6.17

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[2729a60bbfb9215997f25372ebe9b7964f038296,c97ef13ad96be0e08af38dfa2ed40cded0b53e1b)`	affected	code_commit	—
`[2729a60bbfb9215997f25372ebe9b7964f038296,dd33c03cefccdfcb223e9e6262643d64f8c1ae20)`	affected	code_commit	—
`[2729a60bbfb9215997f25372ebe9b7964f038296,2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e)`	affected	code_commit	—
`17ecefc9fdd8c554e0d03f5a990daef19f930add`	affected	code_commit	—
`[6.16.8,6.17)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.17`	affected	semver	—
`[0,6.17)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that incorporates the committing changes shown in the Git references, which corrects the type mismatch and eliminates the null pointer dereference.
If upgrading the kernel cannot be performed immediately, disable or avoid using io_uring IOPOLL on devices that have integrity metadata enabled; reconfiguring the devices to remove or disable the metadata attribute is recommended.
Ensure that the kernel path which returns -EOPNOTSUPP when HIPRI is combined with user metadata is enabled, as this provides a graceful failure path and prevents a crash when the bug is still present.

Generated by OpenCVE AI on October 24, 2026 at 01:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98821.mbox
https://git.kernel.org/stable/c/2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e
https://git.kernel.org/stable/c/c97ef13ad96be0e08af38dfa2ed40cded0b53e1b
https://git.kernel.org/stable/c/dd33c03cefccdfcb223e9e6262643d64f8c1ae20
https://nvd.nist.gov/vuln/detail/CVE-2026-98821
https://www.cve.org/CVERecord?id=CVE-2026-98821

History

Sat, 24 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-843
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98821.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98821 https://www.cve.org/CVERecord?id=CVE-2026-98821
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476 CWE-704

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses __blkdev_direct_IO(), which never publishes the bio for polling, so IOPOLL calls bio_poll() on the uio_meta. Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device (scsi_debug dif=1 dix=1). KASAN reports: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bio_poll+0x9d/0x4b0 Call Trace: iocb_bio_iopoll+0x5b/0x80 io_uring_classic_poll+0xf3/0x140 io_do_iopoll+0x4e3/0xc00 io_iopoll_check+0x275/0x560 __do_sys_io_uring_enter+0x2e5/0x720 Return -EOPNOTSUPP when HIPRI is combined with user metadata.
Title		block: reject polled dio with user integrity metadata
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e https://git.kernel.org/stable/c/c97ef13ad96be0e08af38dfa2ed40cded0b53e1b https://git.kernel.org/stable/c/dd33c03cefccdfcb223e9e6262643d64f8c1ae20

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:49:13.154Z

Updated: 2026-10-19T09:26:14.186Z

Reserved: 2026-09-25T10:25:14.372Z

Link: CVE-2026-98821

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:36.337

Modified: 2026-10-19T10:19:46.173

Link: CVE-2026-98821

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98821 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T01:45:17Z

Weaknesses

CWE-476
NULL Pointer Dereference
CWE-704
Incorrect Type Conversion or Cast
CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object