UBUNTU-CVE-2026-98821: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCBHASMETADATA leaves iocb->private as a uiometa, while iocbbioiopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO(), which never publishes the bio for polling, so IOPOLL calls biopoll() on the uiometa. Reproducer: iouring IOPOLL plus a PI attribute on an integrity device (scsidebug dif=1 dix=1). KASAN reports: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:biopoll+0x9d/0x4b0 Call Trace: iocbbioiopoll+0x5b/0x80 iouringclassicpoll+0xf3/0x140 iodoiopoll+0x4e3/0xc00 ioiopollcheck+0x275/0x560 dosysiouringenter+0x2e5/0x720 Return -EOPNOTSUPP when HIPRI is combined with user metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Reject polled direct I/O when HIPRI is combined with user integrity metadata by returning -EOPNOTSUPP.