Unknown severity · Source severity not reportedCVE-2026-98821

block: reject polled dio with user integrity metadataCVE-2026-98821

Answer in brief

CVE-2026-98821 records a Unknown severity vulnerability in block: reject polled dio with user integrity metadata. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 18, 2026Updated Oct 18, 2026Source checked Oct 18, 2026First seen by HOL Oct 18, 2026Material review Oct 18, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=2729a60bbfb9215997f25372ebe9b7964f038296 <c97ef13ad96be0e08af38dfa2ed40cded0b53e1b \|\| >=2729a60bbfb9215997f25372ebe9b7964f038296 <dd33c03cefccdfcb223e9e6262643d64f8c1ae20 \|\| >=2729a60bbfb9215997f25372ebe9b7964f038296 <2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e \|\| 17ecefc9fdd8c554e0d03e5a990daef19f930add \|\| >=6.16.8 <6.17	c97ef13ad96be0e08af38dfa2ed40cded0b53e1b, dd33c03cefccdfcb223e9e6262643d64f8c1ae20, 2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e, 6.17
Linux/Linuxgeneric	6.17	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to c97ef13ad96be0e08af38dfa2ed40cded0b53e1b if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 18, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses __blkdev_direct_IO(), which never publishes the bio for polling, so IOPOLL calls bio_poll() on the uio_meta. Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device (scsi_debug dif=1 dix=1). KASAN reports: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bio_poll+0x9d/0x4b0 Call Trace: iocb_bio_iopoll+0x5b/0x80 io_uring_classic_poll+0xf3/0x140 io_do_iopoll+0x4e3/0xc00 io_iopoll_check+0x275/0x560 __do_sys_io_uring_enter+0x2e5/0x720 Return -EOPNOTSUPP when HIPRI is combined with user metadata.

Quoted source text, attributed separately from HOL analysis.