CVE-2026-23148: nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix race in nvmetbiodone() leading to NULL pointer dereference
There is a race condition in nvmetbiodone() that can cause a NULL pointer dereference in blkcgroupbiostart():
1. nvmetbiodone() is called when a bio completes 2. nvmetreqcomplete() is called, which invokes req->ops->queueresponse(req) 3. The queueresponse callback can re-queue and re-submit the same request 4. The re-submission reuses the same inlinebio from nvmetreq 5. Meanwhile, nvmetreqbioput() (called after nvmetreqcomplete) invokes biouninit() for inlinebio, which sets bio->biblkg to NULL 6. The re-submitted bio enters submitbionoacctnocheck() 7. blkcgroupbiostart() dereferences bio->biblkg, causing a crash:
BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode RIP: 0010:blkcgroupbiostart+0x10/0xd0 Call Trace: submitbionoacctnocheck+0x44/0x250 nvmetbdevexecuterw+0x254/0x370 [nvmet] processonework+0x193/0x3c0 workerthread+0x281/0x3a0
Fix this by reordering nvmetbiodone() to call nvmetreqbioput() BEFORE nvmetreqcomplete(). This ensures the bio is cleaned up before the request can be re-submitted, preventing the race condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the race by reordering nvmet_bio_done() to call nvmet_req_bio_put() (which runs after nvmet_req_complete in the vulnerable flow) before nvmet_req_complete(), so the inline_bio is cleaned up (bio_uninit sets bio->bi_blkg to NULL) before blk_cgroup_bio_start() dereferences bio->bi_blkg.
Linux kernel nvmet (NVM Express target) nvmet_bio_done() call order = Call nvmet_req_bio_put() before nvmet_req_complete() - Compensating control
Use a compensating control to prevent/reduce triggering the race (e.g., restrict or isolate usage of the nvmet target so that queue_response can’t re-queue/re-submit the same request while bio completion paths run).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23148?
The severity of CVE-2026-23148 is classified as high with a score of 7.5.
What is the risk associated with CVE-2026-23148?
CVE-2026-23148 has a risk rating of 43, indicating significant potential impact.
How do I fix CVE-2026-23148?
To fix CVE-2026-23148, apply the available patch to the affected Linux kernel.
What type of vulnerability is CVE-2026-23148?
CVE-2026-23148 is categorized as a NULL pointer dereference and race condition vulnerability.
Which software is affected by CVE-2026-23148?
CVE-2026-23148 affects the Linux kernel and its associated components.