CVE-2026-98821: block: reject polled dio with user integrity metadata
In the Linux kernel, the following vulnerability has been resolved:
block: reject polled dio with user integrity metadata
IOCBHASMETADATA leaves iocb->private as a uiometa, while iocbbioiopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO(), which never publishes the bio for polling, so IOPOLL calls biopoll() on the uiometa.
Reproducer: iouring IOPOLL plus a PI attribute on an integrity device (scsidebug dif=1 dix=1). KASAN reports:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:biopoll+0x9d/0x4b0 Call Trace: iocbbioiopoll+0x5b/0x80 iouringclassicpoll+0xf3/0x140 iodoiopoll+0x4e3/0xc00 ioiopollcheck+0x275/0x560 dosysiouringenter+0x2e5/0x720
Return -EOPNOTSUPP when HIPRI is combined with user metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Do not combine polled direct I/O (HIPRI/IOPOLL) with user integrity metadata; reject such requests with -EOPNOTSUPP.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using io_uring IOPOLL with direct I/O that supplies user integrity metadata to an integrity-enabled block device are exposed. The provided reproducer uses a SCSI debug device configured with DIF and DIX support.
What does an attacker or local user need to trigger the fault?
They need to issue an io_uring IOPOLL request with the HIPRI mode combined with user-provided integrity metadata. This causes the polling path to treat metadata state as a bio and can result in a kernel fault.
What can be done before applying a fix?
Do not combine HIPRI/I/O polling with user integrity metadata. The resolved behavior rejects that combination with -EOPNOTSUPP.
How can administrators identify a potentially affected workload?
Review applications using io_uring polling for direct I/O requests that attach protection-information or other user integrity metadata. Kernel logs showing a fault in bio_poll called through iocb_bio_iopoll and io_uring polling paths are consistent with this issue.