{"id":"CVE-2026-23148","state":"PUBLISHED","title":"nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference\n\nThere is a race condition in nvmet_bio_done() that can cause a NULL\npointer dereference in blk_cgroup_bio_start():\n\n1. nvmet_bio_done() is called when a bio completes\n2. nvmet_req_complete() is called, which invokes req->ops->queue_response(req)\n3. The queue_response callback can re-queue and re-submit the same request\n4. The re-submission reuses the same inline_bio from nvmet_req\n5. Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete)\n   invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL\n6. The re-submitted bio enters submit_bio_noacct_nocheck()\n7. blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000028\n  #PF: supervisor read access in kernel mode\n  RIP: 0010:blk_cgroup_bio_start+0x10/0xd0\n  Call Trace:\n   submit_bio_noacct_nocheck+0x44/0x250\n   nvmet_bdev_execute_rw+0x254/0x370 [nvmet]\n   process_one_work+0x193/0x3c0\n   worker_thread+0x281/0x3a0\n\nFix this by reordering nvmet_bio_done() to call nvmet_req_bio_put()\nBEFORE nvmet_req_complete(). This ensures the bio is cleaned up before\nthe request can be re-submitted, preventing the race condition.","publishedAt":"2026-02-14T16:01:17.575Z","updatedAt":"2026-10-19T18:25:33.568Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"431e58d56fcb5ff1f9eb630724a922e0d2a941df","status":"affected","lessThan":"ee10b06980acca1d46e0fa36d6fb4a9578eab6e4","versionType":"git"},{"version":"190f4c2c863af7cc5bb354b70e0805f06419c038","status":"affected","lessThan":"68207ceefd71cc74ce4e983fa9bd10c3122e349b","versionType":"git"},{"version":"190f4c2c863af7cc5bb354b70e0805f06419c038","status":"affected","lessThan":"0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e","versionType":"git"},{"version":"2e2028fcf924d1c6df017033c8d6e28b735a0508","status":"affected","versionType":"git"},{"version":"6.12.37","status":"affected","lessThan":"6.12.69","versionType":"semver"},{"version":"6.15.6","status":"affected","lessThan":"6.16","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/io-cmd-bdev.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.16","versionType":"semver"},{"version":"6.12.69","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.9","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/io-cmd-bdev.c"]}],"references":["https://git.kernel.org/stable/c/ee10b06980acca1d46e0fa36d6fb4a9578eab6e4","https://git.kernel.org/stable/c/68207ceefd71cc74ce4e983fa9bd10c3122e349b","https://git.kernel.org/stable/c/0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e"],"weaknesses":["CWE-362"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/23xxx/CVE-2026-23148.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-23148","state":"PUBLISHED","datePublished":"2026-02-14T16:01:17.575Z","dateUpdated":"2026-10-19T18:25:33.568Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-01-13T15:37:45.975Z"},"containers":{"cna":{"title":"nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference\n\nThere is a race condition in nvmet_bio_done() that can cause a NULL\npointer dereference in blk_cgroup_bio_start():\n\n1. nvmet_bio_done() is called when a bio completes\n2. nvmet_req_complete() is called, which invokes req->ops->queue_response(req)\n3. The queue_response callback can re-queue and re-submit the same request\n4. The re-submission reuses the same inline_bio from nvmet_req\n5. Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete)\n   invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL\n6. The re-submitted bio enters submit_bio_noacct_nocheck()\n7. blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000028\n  #PF: supervisor read access in kernel mode\n  RIP: 0010:blk_cgroup_bio_start+0x10/0xd0\n  Call Trace:\n   submit_bio_noacct_nocheck+0x44/0x250\n   nvmet_bdev_execute_rw+0x254/0x370 [nvmet]\n   process_one_work+0x193/0x3c0\n   worker_thread+0x281/0x3a0\n\nFix this by reordering nvmet_bio_done() to call nvmet_req_bio_put()\nBEFORE nvmet_req_complete(). This ensures the bio is cleaned up before\nthe request can be re-submitted, preventing the race condition."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"431e58d56fcb5ff1f9eb630724a922e0d2a941df","status":"affected","lessThan":"ee10b06980acca1d46e0fa36d6fb4a9578eab6e4","versionType":"git"},{"version":"190f4c2c863af7cc5bb354b70e0805f06419c038","status":"affected","lessThan":"68207ceefd71cc74ce4e983fa9bd10c3122e349b","versionType":"git"},{"version":"190f4c2c863af7cc5bb354b70e0805f06419c038","status":"affected","lessThan":"0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e","versionType":"git"},{"version":"2e2028fcf924d1c6df017033c8d6e28b735a0508","status":"affected","versionType":"git"},{"version":"6.12.37","status":"affected","lessThan":"6.12.69","versionType":"semver"},{"version":"6.15.6","status":"affected","lessThan":"6.16","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/io-cmd-bdev.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.16","versionType":"semver"},{"version":"6.12.69","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.9","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/nvme/target/io-cmd-bdev.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ee10b06980acca1d46e0fa36d6fb4a9578eab6e4"},{"url":"https://git.kernel.org/stable/c/68207ceefd71cc74ce4e983fa9bd10c3122e349b"},{"url":"https://git.kernel.org/stable/c/0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The nvmet (NVMe target) subsystem is reachable over the network via nvmet-tcp on TCP port 4420, allowing a remote NVMe-oF initiator to send I/O commands that trigger the vulnerable bio completion path.\nAC:L - The attacker controls both sides of the race by sending concurrent I/O commands at high queue depth over nvmet-tcp; the race between bio completion and request re-submission via the workqueue is reliably triggerable under load, as confirmed by the real crash trace in the commit message.\nPR:N - NVMe-oF over TCP does not require authentication by default; DH-HMAC-CHAP auth is optional and commonly not configured, and the hostnqn in the connect command is an unauthenticated string that can be spoofed.\nUI:N - No user interaction is required; the attacker autonomously sends NVMe I/O commands over the network to trigger the race condition.\nS:U - The vulnerability crashes the kernel within the same security authority; there is no crossing of security boundaries such as VM escape or sandbox bypass.\nC:N - The immediate impact is a NULL pointer dereference crash; no information is disclosed to the attacker as the kernel panics without leaking memory contents back over the network.\nI:N - The bug results in a kernel crash via NULL dereference, not data modification; the bio_uninit zeroing of fields on the live bio does not give the attacker a write primitive that could modify persistent data.\nA:H - The NULL pointer dereference in blk_cgroup_bio_start causes a kernel oops/panic, completely crashing the system and denying service to all users; this is remotely triggerable and repeatable."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:20:22.785Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.37","versionEndExcluding":"6.12.69"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.18.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15.6"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-23148","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:06:34.978751Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","lang":"en","type":"CWE","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:25:33.568Z"}}]}}}