CVE-2026-98821
In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses __blkdev_direct_IO(), which never publishes the bio for polling, so IOPOLL calls bio_poll() on the uio_meta. Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device (scsi_debug dif=1 dix=1). KASAN reports: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bio_poll+0x9d/0x4b0 Call Trace: iocb_bio_iopoll+0x5b/0x80 io_uring_classic_poll+0xf3/0x140 io_do_iopoll+0x4e3/0xc00 io_iopoll_check+0x275/0x560 __do_sys_io_uring_enter+0x2e5/0x720 Return -EOPNOTSUPP when HIPRI is combined with user metadata.
Affected versions
Linux kernel versions
6.16.8,
6.17
and later are affected. Fixed in
6.18.56,
7.2.10,
7.3
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-98821?
CVE-2026-98821 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.16.8 onward and has been patched in 6.18.56, 7.2.10 and 7.3. CVE-2026-98821 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98821?
Yes. CVE-2026-98821 has been patched. Fixed versions include 6.18.56, 7.2.10 and 7.3. If you are running Linux kernel 6.16.8 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98821 actively exploited?
No. CVE-2026-98821 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.