CVE-2026-23148

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23148
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23148.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-23148
Downstream
BELL (1)
DEBIAN (1)
openSUSE (1)
ROOT (1)
SUSE (4)
UBUNTU (1)
Related
openSUSE (1)
SUSE (4)
Published
2026-02-14T16:01:17Z
Modified
2026-10-20T10:30:37Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
Details

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference

There is a race condition in nvmet_bio_done() that can cause a NULL pointer dereference in blk_cgroup_bio_start():

  1. nvmet_bio_done() is called when a bio completes
  2. nvmet_req_complete() is called, which invokes req->ops->queue_response(req)
  3. The queue_response callback can re-queue and re-submit the same request
  4. The re-submission reuses the same inline_bio from nvmet_req
  5. Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete) invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL
  6. The re-submitted bio enters submit_bio_noacct_nocheck()
  7. blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash:

BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode RIP: 0010:blk_cgroup_bio_start+0x10/0xd0 Call Trace: submit_bio_noacct_nocheck+0x44/0x250 nvmet_bdev_execute_rw+0x254/0x370 [nvmet] process_one_work+0x193/0x3c0 worker_thread+0x281/0x3a0

Fix this by reordering nvmet_bio_done() to call nvmet_req_bio_put() BEFORE nvmet_req_complete(). This ensures the bio is cleaned up before the request can be re-submitted, preventing the race condition.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23148.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
431e58d56fcb5ff1f9eb630724a922e0d2a941df
Fixed
ee10b06980acca1d46e0fa36d6fb4a9578eab6e4
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
190f4c2c863af7cc5bb354b70e0805f06419c038
Fixed
68207ceefd71cc74ce4e983fa9bd10c3122e349b
Fixed
0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.12.37
Fixed
6.12.69
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.15.6
Fixed
6.16
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
2e2028fcf924d1c6df017033c8d6e28b735a0508

Affected versions

v6.*
v6.12.37
v6.12.38
v6.12.39
v6.12.40
v6.12.41
v6.12.42
v6.12.43
v6.12.44
v6.12.45
v6.12.46
v6.12.47
v6.12.48
v6.12.49
v6.12.50
v6.12.51
v6.12.52
v6.12.53
v6.12.54
v6.12.55
v6.12.56
v6.12.57
v6.12.58
v6.12.59
v6.12.60
v6.12.61
v6.12.62
v6.12.63
v6.12.64
v6.12.65
v6.12.66
v6.12.67
v6.12.68
v6.15.10
v6.15.11
v6.15.6
v6.15.7
v6.15.8
v6.15.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23148.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.12.69
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23148.json"