SB20261022437 - Type Confusion in Linux kernel block

Description

This security bulletin contains information about 1 vulnerability.

1) Type Confusion (CVE-ID: CVE-2026-98821)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel fault.

The vulnerability exists due to type confusion in the Linux kernel block direct I/O polling path when processing polled I/O with user integrity metadata. A local user can submit io_uring IOPOLL requests with a protection information attribute on an integrity device, causing bio_poll() to interpret a uio_meta object as a bio object and trigger a kernel fault.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e
• https://git.kernel.org/stable/c/c97ef13ad96be0e08af38dfa2ed40cded0b53e1b
• https://git.kernel.org/stable/c/dd33c03cefccdfcb223e9e6262643d64f8c1ae20