CVE-2026-23148
Unknown Unknown - Not Provided
Race Condition in Linux nvmet Causes NULL Pointer Dereference

Publication date: 2026-02-14

Last updated on: 2026-04-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference There is a race condition in nvmet_bio_done() that can cause a NULL pointer dereference in blk_cgroup_bio_start(): 1. nvmet_bio_done() is called when a bio completes 2. nvmet_req_complete() is called, which invokes req->ops->queue_response(req) 3. The queue_response callback can re-queue and re-submit the same request 4. The re-submission reuses the same inline_bio from nvmet_req 5. Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete) invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL 6. The re-submitted bio enters submit_bio_noacct_nocheck() 7. blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash: BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode RIP: 0010:blk_cgroup_bio_start+0x10/0xd0 Call Trace: submit_bio_noacct_nocheck+0x44/0x250 nvmet_bdev_execute_rw+0x254/0x370 [nvmet] process_one_work+0x193/0x3c0 worker_thread+0x281/0x3a0 Fix this by reordering nvmet_bio_done() to call nvmet_req_bio_put() BEFORE nvmet_req_complete(). This ensures the bio is cleaned up before the request can be re-submitted, preventing the race condition.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-14
Last Modified
2026-04-03
Generated
2026-06-16
AI Q&A
2026-02-14
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23148
EUVD
EUVD-2026-5887
Affected Vendors & Products
Showing 14 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel From 6.12.37 (inc) to 6.12.69 (exc)
linux linux_kernel From 6.15.6 (inc) to 6.16 (exc)
linux linux_kernel From 6.16.1 (inc) to 6.18.9 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in the Linux kernel's nvmet module, specifically in the function nvmet_bio_done().

When a bio (block I/O operation) completes, nvmet_bio_done() is called, which eventually leads to re-queuing and re-submitting the same request. However, due to the order of operations, the bio's internal data structure (inline_bio) is cleaned up (its bi_blkg field set to NULL) after the request is completed but before the re-submission.

This causes a NULL pointer dereference in blk_cgroup_bio_start() when it tries to access bio->bi_blkg, leading to a kernel crash.

The fix involves reordering the calls in nvmet_bio_done() to ensure the bio is cleaned up before the request can be re-submitted, preventing the race condition.

Impact Analysis

This vulnerability can cause a kernel NULL pointer dereference, which leads to a kernel crash (system crash or panic).

Such crashes can result in denial of service (DoS) conditions, making the affected system unstable or unavailable until it is rebooted or the issue is resolved.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The vulnerability is caused by a race condition in the Linux kernel's nvmet module leading to a NULL pointer dereference and kernel crash.

To mitigate this vulnerability, update your Linux kernel to a version where the nvmet_bio_done() function has been fixed by reordering calls so that nvmet_req_bio_put() is called before nvmet_req_complete(). This ensures proper cleanup of the bio before any re-submission, preventing the race condition.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart