CVE-2026-23148: nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference

Q: What is the severity of CVE-2026-23148?

The severity of CVE-2026-23148 is classified as high with a score of 7.5.

Q: What is the risk associated with CVE-2026-23148?

CVE-2026-23148 has a risk rating of 43, indicating significant potential impact.

Q: How do I fix CVE-2026-23148?

To fix CVE-2026-23148, apply the available patch to the affected Linux kernel.

Q: What type of vulnerability is CVE-2026-23148?

CVE-2026-23148 is categorized as a NULL pointer dereference and race condition vulnerability.

Q: Which software is affected by CVE-2026-23148?

CVE-2026-23148 affects the Linux kernel and its associated components.

Published Feb 14, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix race in nvmetbiodone() leading to NULL pointer dereference

There is a race condition in nvmetbiodone() that can cause a NULL pointer dereference in blkcgroupbiostart():

1. nvmetbiodone() is called when a bio completes 2. nvmetreqcomplete() is called, which invokes req->ops->queueresponse(req) 3. The queueresponse callback can re-queue and re-submit the same request 4. The re-submission reuses the same inlinebio from nvmetreq 5. Meanwhile, nvmetreqbioput() (called after nvmetreqcomplete) invokes biouninit() for inlinebio, which sets bio->biblkg to NULL 6. The re-submitted bio enters submitbionoacctnocheck() 7. blkcgroupbiostart() dereferences bio->biblkg, causing a crash:

BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode RIP: 0010:blkcgroupbiostart+0x10/0xd0 Call Trace: submitbionoacctnocheck+0x44/0x250 nvmetbdevexecuterw+0x254/0x370 [nvmet] processonework+0x193/0x3c0 workerthread+0x281/0x3a0

Fix this by reordering nvmetbiodone() to call nvmetreqbioput() BEFORE nvmetreqcomplete(). This ensures the bio is cleaned up before the request can be re-submitted, preventing the race condition.

Affected Software

163 affected componentsFixes available

linux/kernel

Linux Linux kernel>=6.12.37<6.12.69

Linux Linux kernel>=6.15.6<6.16

Linux Linux kernel>=6.16.1<6.18.9

Linux Linux kernel=6.16

Linux Linux kernel=6.16-rc5

Linux Linux kernel=6.16-rc6

Linux Linux kernel=6.16-rc7

Linux Linux kernel=6.19-rc1

Linux Linux kernel=6.19-rc2

Linux Linux kernel=6.19-rc3

Linux Linux kernel=6.19-rc4

Linux Linux kernel=6.19-rc5

Linux Linux kernel=6.19-rc6

Linux Linux kernel=6.19-rc7

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1057.60~22.04.1

6.8.0-1057.60~22.04.1

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1059.65~22.04.1

6.8.0-1059.65~22.04.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1058.65~22.04.1

6.8.0-1058.65~22.04.1

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1060.63~22.04.1

6.8.0-1060.63~22.04.1

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-124.124~22.04.1

6.8.0-124.124~22.04.1

ubuntu/linux-ibm-6.8<6.8.0-1055.56~22.04.1

6.8.0-1055.56~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-117.117.1~22.04.1

6.8.0-117.117.1~22.04.1

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1054.57~22.04.1

6.8.0-1054.57~22.04.1

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1054.55~22.04.1

6.8.0-1054.55~22.04.1

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-117.117~22.04.1

6.8.0-117.117~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8<6.8.1-1051.52~22.04.1

6.8.1-1051.52~22.04.1

ubuntu/linux<6.8.0-117.117

6.8.0-117.117

ubuntu/linux-aws<6.8.0-1055.58

6.8.0-1055.58

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-azure<6.8.0-1056.62

6.8.0-1056.62

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17<6.17.0-1021.21~24.04.1

6.17.0-1021.21~24.04.1

ubuntu/linux-azure-fde<6.8.0-1058.65

6.8.0-1058.65

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1058.61

6.8.0-1058.61

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-6.17<6.17.0-1021.24~24.04.1

6.17.0-1021.24~24.04.1

ubuntu/linux-gke<6.8.0-1054.60

6.8.0-1054.60

ubuntu/linux-gkeop<6.8.0-1041.44

6.8.0-1041.44

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17<6.17.0-41.41~24.04.1

6.17.0-41.41~24.04.1

ubuntu/linux-ibm<6.8.0-1055.56

6.8.0-1055.56

ubuntu/linux-lowlatency<6.8.0-117.117.1

6.8.0-117.117.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1054.57

6.8.0-1054.57

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17<6.17.0-1031.31

6.17.0-1031.31

ubuntu/linux-nvidia-lowlatency<6.8.0-1054.57.1

6.8.0-1054.57.1

ubuntu/linux-nvidia-tegra<6.8.0-1024.24

6.8.0-1024.24

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17<6.17.0-1030.30

6.17.0-1030.30

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1054.55

6.8.0-1054.55

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17<6.17.0-1019.19~24.04.3

6.17.0-1019.19~24.04.3

ubuntu/linux-raspi<6.8.0-1056.60

6.8.0-1056.60

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-xilinx<6.8.0-1032.33

6.8.0-1032.33

ubuntu/linux-bluefield<6.8.0-1022.26

6.8.0-1022.26

ubuntu/linux-raspi-realtime<6.8.0-2045.46

6.8.0-2045.46

ubuntu/linux-realtime<6.8.1-1051.52

6.8.1-1051.52

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17<6.17.0-1018.20~24.04.1

6.17.0-1018.20~24.04.1

ubuntu/linux-aws-fips<6.8.0-1055.58+fips1

6.8.0-1055.58+fips1

ubuntu/linux-azure-fips<6.8.0-1059.65+fips1

6.8.0-1059.65+fips1

ubuntu/linux-fips<6.8.0-116.116+fips1

6.8.0-116.116+fips1

ubuntu/linux-gcp-fips<6.8.0-1058.61+fips1

6.8.0-1058.61+fips1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp*

ubuntu/linux-oracle*

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1057.60~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.65~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.65~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.63~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-124.124~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1055.56~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-117.117.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1054.57~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1054.55~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-117.117~22.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1051.52~22.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-117.117
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1055.58
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1056.62
Upgrade
Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1021.21~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.65
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61
Upgrade
Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1021.24~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1054.60
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1041.44
Upgrade
Upgrade ubuntu/linux-hwe-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-41.41~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1055.56
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-117.117.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1054.57
Upgrade
Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1031.31
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1054.57.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1024.24
Upgrade
Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1030.30
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1054.55
Upgrade
Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1019.19~24.04.3
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1056.60
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1032.33
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1022.26
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2045.46
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1051.52
Upgrade
Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1018.20~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1055.58+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.65+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-116.116+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61+fips1

Event History

Feb 14, 2026

CVE Published

via MITRE·04:01 PM

Data Sourced

via MITRE·04:01 PM

DescriptionSeverity

Data Sourced

via OSV·04:15 PM

DescriptionSeverityAffected Software

Event

via OSV·04:15 PM

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-23148?

The severity of CVE-2026-23148 is classified as high with a score of 7.5.

What is the risk associated with CVE-2026-23148?

CVE-2026-23148 has a risk rating of 43, indicating significant potential impact.

How do I fix CVE-2026-23148?

To fix CVE-2026-23148, apply the available patch to the affected Linux kernel.

What type of vulnerability is CVE-2026-23148?

CVE-2026-23148 is categorized as a NULL pointer dereference and race condition vulnerability.

Which software is affected by CVE-2026-23148?

CVE-2026-23148 affects the Linux kernel and its associated components.

CVE-2026-23148: nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2026-23148?

What is the risk associated with CVE-2026-23148?

How do I fix CVE-2026-23148?

What type of vulnerability is CVE-2026-23148?

Which software is affected by CVE-2026-23148?

Company

Resources

Contact