{"id":"CVE-2026-98821","kind":"vulnerability","aliases":["CVE-2026-98821"],"related":[],"title":"Linux kernel: polled direct I/O with user metadata crashes the block layer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: reject polled dio with user integrity metadata\n\nIOCB_HAS_METADATA leaves iocb->private as a uio_meta, while\niocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O\nalways uses __blkdev_direct_IO(), which never publishes the bio for\npolling, so IOPOLL calls bio_poll() on the uio_meta.\n\nReproducer: io_uring IOPOLL plus a PI attribute on an integrity device\n(scsi_debug dif=1 dix=1). KASAN reports:\n\n  Oops: general protection fault, probably for non-canonical\n  address 0xdffffc0000000004\n  KASAN: null-ptr-deref in range\n  [0x0000000000000020-0x0000000000000027]\n  RIP: 0010:bio_poll+0x9d/0x4b0\n  Call Trace:\n   iocb_bio_iopoll+0x5b/0x80\n   io_uring_classic_poll+0xf3/0x140\n   io_do_iopoll+0x4e3/0xc00\n   io_iopoll_check+0x275/0x560\n   __do_sys_io_uring_enter+0x2e5/0x720\n\nReturn -EOPNOTSUPP when HIPRI is combined with user metadata.","summary":"The Linux kernel block layer mishandles io_uring polled direct I/O when user integrity metadata is attached, dereferencing the wrong object and causing a kernel crash (KASAN null-pointer dereference in bio_poll). The sources describe a kernel oops reachable through io_uring IOPOLL on a protection-information device; they do not describe code execution or data disclosure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["block-devices","io-uring","linux-kernel","runtime"],"not_affected_if":["no-integrity-devices"],"how_to_check":"- unknown","fix":"- Apply the Linux kernel stable update that contains the upstream commit rejecting polled DIO with user integrity metadata (returns -EOPNOTSUPP on HIPRI with metadata); the sources do not name a version.","status":"open","published_at":"2026-10-18T16:17:36+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:14:42+00:00","updated_at":"2026-10-25T05:14:42+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:14:42Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Linux kernel stable update that contains the upstream commit rejecting polled DIO with user integrity metadata (returns -EOPNOTSUPP on HIPRI with metadata); the sources do not name a version.","reach":"local","title":"Linux kernel: polled direct I/O with user metadata crashes the block layer","impact":"medium","summary":"The Linux kernel block layer mishandles io_uring polled direct I/O when user integrity metadata is attached, dereferencing the wrong object and causing a kernel crash (KASAN null-pointer dereference in bio_poll). The sources describe a kernel oops reachable through io_uring IOPOLL on a protection-information device; they do not describe code execution or data disclosure.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","io-uring","block-devices"],"confidence":0.6,"needs_auth":"yes","worst_case":"local process crashes the kernel via a general protection fault","analyst_note":"Check the kernel.org stable commit and the fixed version numbers per stable branch at https://nvd.nist.gov/vuln/detail/CVE-2026-98821; sources give no versions.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-integrity-devices"],"who_is_affected":"Systems running a Linux kernel with io_uring and block devices that carry protection-information (integrity) metadata, where a local process can submit IOPOLL requests with user metadata. Machines without integrity-capable block devices or without io_uring polling are unlikely to be affected; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":3667,"output_tokens":589,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':194C,201C,207C,212C,217C,224C '-2026':14A,17A '-98821':15A,18A '0010':191C '0x0000000000000020':188C '0x0000000000000020-0x0000000000000027':187C '0x0000000000000027':189C '0xdffffc0000000004':179C '1':164C,166C '2729a60bbfb9':125C 'address':178C 'alway':128C 'attach':45B 'attribut':156C 'bio':61B,119C,123C,137C,143C,192C,199C 'blkdev':130C 'block':11A,20B,32B,99C 'block-devic':19B 'call':142C,196C 'canon':177C 'caus':51B 'check':216C 'classic':205C 'code':84B 'combin':231C 'crash':9A,54B 'cve':13A,16A 'data':87B 'debug':162C 'deref':184C 'derefer':59B 'dereferenc':46B 'describ':65B,83B 'devic':21B,79B,160C 'dif':163C 'dio':102C 'direct':4A,38B,131C 'disclosur':88B 'dix':165C 'enter':223C 'eopnotsupp':227C 'execut':85B 'expect':121C 'fault':172C 'follow':94C 'general':170C 'hipri':229C 'i/o':5A,39B,127C 'inform':78B 'integr':42B,105C,159C 'io':23B,35B,71B,132C,150C,203C,209C,214C,221C 'io-ur':22B 'iocb':107C,111C,118C,198C 'iopol':73B,120C,141C,152C,200C,211C,215C 'kasan':55B,167C,180C 'kernel':2A,27B,31B,53B,67B,92C 'layer':12A,33B 'leav':110C 'linux':1A,26B,30B,91C 'linux-kernel':25B 'meta':116C,148C 'metadata':8A,43B,106C,109C,126C,234C 'mishandl':34B 'never':134C 'non':176C 'non-canon':175C 'null':57B,182C 'null-point':56B 'null-ptr-deref':181C 'object':49B 'oop':68B,169C 'pi':155C 'plus':153C 'pointer':58B 'poll':3A,37B,62B,101C,139C,144C,193C,206C 'privat':112C 'probabl':173C 'protect':77B,171C 'protection-inform':76B 'ptr':183C 'publish':135C 'rang':186C 'reachabl':69B 'reject':100C 'report':168C 'reproduc':149C 'resolv':98C 'return':226C 'rip':190C 'runtim':28B 'scsi':161C 'sinc':124C 'sourc':64B 'sys':220C 'trace':197C 'uio':115C,147C 'ure':24B,36B,72B,151C,204C,222C 'use':129C 'user':7A,41B,104C,233C 'vulner':95C 'wrong':48B 'x275/0x560':218C 'x2e5/0x720':225C 'x4e3/0xc00':213C 'x5b/0x80':202C 'x9d/0x4b0':195C 'xf3/0x140':208C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with io_uring and block devices that carry protection-information (integrity) metadata, where a local process can submit IOPOLL requests with user metadata. Machines without integrity-capable block devices or without io_uring polling are unlikely to be affected; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98821","severity":null,"published_at":"2026-10-18T16:17:36+00:00","modified_at":"2026-10-19T10:19:46+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}