CVE-2026-23148

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference

There is a race condition in nvmet_bio_done() that can cause a NULL

pointer dereference in blk_cgroup_bio_start():

1. nvmet_bio_done() is called when a bio completes

2. nvmet_req_complete() is called, which invokes req->ops->queue_response(req)

3. The queue_response callback can re-queue and re-submit the same request

4. The re-submission reuses the same inline_bio from nvmet_req

5. Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete)

invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL

6. The re-submitted bio enters submit_bio_noacct_nocheck()

7. blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash:

BUG: kernel NULL pointer dereference, address: 0000000000000028

#PF: supervisor read access in kernel mode

RIP: 0010:blk_cgroup_bio_start+0x10/0xd0

Call Trace:

submit_bio_noacct_nocheck+0x44/0x

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References