CVE-2026-98821: block: reject polled dio with user integrity metadata

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

block: reject polled dio with user integrity metadata

IOCBHASMETADATA leaves iocb->private as a uiometa, while iocbbioiopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO(), which never publishes the bio for polling, so IOPOLL calls biopoll() on the uiometa.

Reproducer: iouring IOPOLL plus a PI attribute on an integrity device (scsidebug dif=1 dix=1). KASAN reports:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:biopoll+0x9d/0x4b0 Call Trace: iocbbioiopoll+0x5b/0x80 iouringclassicpoll+0xf3/0x140 iodoiopoll+0x4e3/0xc00 ioiopollcheck+0x275/0x560 dosysiouringenter+0x2e5/0x720

Return -EOPNOTSUPP when HIPRI is combined with user metadata.

Affected Software

1 affected component

Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Reject polled direct I/O when HIPRI/IOPOLL is combined with user integrity metadata by returning -EOPNOTSUPP.

Event History

Oct 18, 2026

CVE Published

via MITRE·03:49 PM

Data Sourced

via MITRE·03:49 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using io_uring IOPOLL with direct I/O that supplies user integrity metadata to an integrity-enabled block device are exposed. The provided reproducer uses a SCSI debug device configured with DIF and DIX support.

What does an attacker or local user need to trigger the fault?

They need to issue an io_uring IOPOLL request with the HIPRI mode combined with user-provided integrity metadata. This causes the polling path to treat metadata state as a bio and can result in a kernel fault.

What can be done before applying a fix?

Do not combine HIPRI/I/O polling with user integrity metadata. The resolved behavior rejects that combination with -EOPNOTSUPP.

How can administrators identify a potentially affected workload?

Review applications using io_uring polling for direct I/O requests that attach protection-information or other user integrity metadata. Kernel logs showing a fault in bio_poll called through iocb_bio_iopoll and io_uring polling paths are consistent with this issue.

CVE-2026-98821: block: reject polled dio with user integrity metadata

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker or local user need to trigger the fault?

What can be done before applying a fix?

How can administrators identify a potentially affected workload?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker or local user need to trigger the fault?

What can be done before applying a fix?

How can administrators identify a potentially affected workload?