Live › vulnerability › CVE-2026-98821
Go to dashboardThe Linux kernel block layer mishandles io_uring polled direct I/O when user integrity metadata is attached, dereferencing the wrong object and causing a kernel crash (KASAN null-pointer dereference in bio_poll). The sources describe a kernel oops reachable through io_uring IOPOLL on a protection-information device; they do not describe code execution or data disclosure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with io_uring and block devices that carry protection-information (integrity) metadata, where a local process can submit IOPOLL requests with user metadata. Machines without integrity-capable block devices or without io_uring polling are unlikely to be affected; the sources do not say more.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
block: reject polled dio with user integrity metadata
IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses __blkdev_direct_IO(), which never publishes the bio for polling, so IOPOLL calls bio_poll() on the uio_meta.
Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device (scsi_debug dif=1 dix=1). KASAN reports:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bio_poll+0x9d/0x4b0 Call Trace: iocb_bio_iopoll+0x5b/0x80 io_uring_classic_poll+0xf3/0x140 io_do_iopoll+0x4e3/0xc00 io_iopoll_check+0x275/0x560 __do_sys_io_uring_enter+0x2e5/0x720
Return -EOPNOTSUPP when HIPRI is combined with user metadata.
This page as .md · .json · in your agent: get_signal("CVE-2026-98821")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.