CVE-2026-98821
Description
In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses __blkdev_direct_IO(), which never publishes the bio for polling, so IOPOLL calls bio_poll() on the uio_meta. Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device (scsi_debug dif=1 dix=1). KASAN reports: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bio_poll+0x9d/0x4b0 Call Trace: iocb_bio_iopoll+0x5b/0x80 io_uring_classic_poll+0xf3/0x140 io_do_iopoll+0x4e3/0xc00 io_iopoll_check+0x275/0x560 __do_sys_io_uring_enter+0x2e5/0x720 Return -EOPNOTSUPP when HIPRI is combined with user metadata.
How to fix
- Linux Linuxc97ef13ad96be0e08af38dfa2ed40cded0b53e1b, dd33c03cefccdfcb223e9e6262643d64f8c1ae20, 2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e, 6.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 2729a60bbfb9215997f25372ebe9b7964f038296 ≤ v < c97ef13ad96be0e08af38dfa2ed40cded0b53e1b, 2729a60bbfb9215997f25372ebe9b7964f038296 ≤ v < dd33c03cefccdfcb223e9e6262643d64f8c1ae20, 2729a60bbfb9215997f25372ebe9b7964f038296 ≤ v < 2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e, 17ecefc9fdd8c554e0d03e5a990daef19f930add, 6.16.8 ≤ v < 6.17, 6.17 | c97ef13ad96be0e08af38dfa2ed40cded0b53e1b, dd33c03cefccdfcb223e9e6262643d64f8c1ae20, 2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e, 6.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.