In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB_HAS_METADATA leaves… (CVE-2026-98821)

The Linux kernel vulnerability (CVE-2026-98821) involves a mismatch in the handling of polled direct I/O (DIO) operations with user integrity metadata. Specifically, IOCB_HAS_METADATA leaves the iocb->private pointer as a uio_meta structure, whereas the iocb_bio_iopoll() function expects a bio pointer. Since metadata I/O always uses __blkdev_direct_IO(), which does not publish the bio for polling, the IOPOLL mechanism calls bio_poll() on a uio_meta pointer, leading to a general protection fault and kernel crash. This can be reproduced using io_uring IOPOLL combined with a PI attribute on an integrity device (e.g., scsi_debug with dif=1 dix=1). The kernel's KASAN detects a null pointer dereference in this scenario. The resolution is to reject polled DIO with user integrity metadata and return an error (-EOPNOTSUPP) when HIPRI is combined with user metadata.

The vulnerability causes a kernel crash (general protection fault) due to a null pointer dereference when polled direct I/O with user integrity metadata is used improperly. This can lead to denial of service on affected systems using io_uring with integrity devices configured with PI attributes. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to reject polled direct I/O operations with user integrity metadata. Systems should apply the official kernel update that includes this fix. Until patched, avoid using polled DIO with user metadata and HIPRI combinations on integrity devices. Patch status is not explicitly stated in the input data; check the vendor advisory for the current remediation guidance.