CVE-2026-98821
Received Received - Intake

Null Pointer Dereference in Linux Kernel IO_URING

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses __blkdev_direct_IO(), which never publishes the bio for polling, so IOPOLL calls bio_poll() on the uio_meta. Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device (scsi_debug dif=1 dix=1). KASAN reports: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bio_poll+0x9d/0x4b0 Call Trace: iocb_bio_iopoll+0x5b/0x80 io_uring_classic_poll+0xf3/0x140 io_do_iopoll+0x4e3/0xc00 io_iopoll_check+0x275/0x560 __do_sys_io_uring_enter+0x2e5/0x720 Return -EOPNOTSUPP when HIPRI is combined with user metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98821
EUVD
EUVD-2026-103906

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux 2729a60bbfb9215997f25372ebe9b7964f038296
Linux Linux 2729a60bbfb9215997f25372ebe9b7964f038296
Linux Linux 2729a60bbfb9215997f25372ebe9b7964f038296
Linux Linux 17ecefc9fdd8c554e0d03e5a990daef19f930add
Linux Linux 6.16.8
Linux Linux 6.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a conflict when using polled direct I/O with user integrity metadata. The issue arises because IOCB_HAS_METADATA treats iocb->private as a uio_meta, but iocb_bio_iopoll() expects a bio structure. This mismatch leads to a null-pointer dereference when bio_poll() is called on the uio_meta, causing a general protection fault.

Detection Guidance

This vulnerability is specific to the Linux kernel and involves io_uring IOPOLL with integrity metadata. Detection requires checking kernel logs for KASAN reports or general protection faults related to bio_poll or io_uring operations. Examine system logs for crashes or errors during I/O operations with integrity metadata.

Impact Analysis

This vulnerability can cause system crashes or instability when performing I/O operations with integrity metadata enabled. It specifically affects systems using io_uring with IOPOLL and integrity attributes, potentially leading to kernel oops or denial of service.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Disable io_uring IOPOLL if integrity metadata is used. Monitor kernel updates from your distribution and test patches before deployment. Avoid using PI attributes on integrity devices with io_uring.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98821. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart