nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference There is a race condition in nvmet_bio_done() that can cause a NULL pointer dereference in blk_cgroup_bio_start(): 1. nvmet_bio_done() is called when a bio completes 2. nvmet_req_complete() is called, which invokes req->ops->queue_response(req) 3. The queue_response callback can re-queue and re-submit the same request 4. The re-submission reuses the same inline_bio from nvmet_req 5. Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete) invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL 6. The re-submitted bio enters submit_bio_noacct_nocheck() 7. blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash: BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode RIP: 0010:blk_cgroup_bio_start+0x10/0xd0 Call Trace: submit_bio_noacct_nocheck+0x44/0x250 nvmet_bdev_execute_rw+0x254/0x370 [nvmet] process_one_work+0x193/0x3c0 worker_thread+0x281/0x3a0 Fix this by reordering nvmet_bio_done() to call nvmet_req_bio_put() BEFORE nvmet_req_complete(). This ensures the bio is cleaned up before the request can be re-submitted, preventing the race condition.
CVE-2026-23148
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-23148
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "431e58d56fcb5ff1f9eb630724a922e0d2a941df",
"lessThan": "ee10b06980acca1d46e0fa36d6fb4a9578eab6e4",
"versionType": "git"
},
{
"status": "affected",
"version": "190f4c2c863af7cc5bb354b70e0805f06419c038",
"lessThan": "68207ceefd71cc74ce4e983fa9bd10c3122e349b",
"versionType": "git"
},
{
"status": "affected",
"version": "190f4c2c863af7cc5bb354b70e0805f06419c038",
"lessThan": "0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e",
"versionType": "git"
},
{
"status": "affected",
"version": "2e2028fcf924d1c6df017033c8d6e28b735a0508",
"versionType": "git"
},
{
"status": "affected",
"version": "6.12.37",
"lessThan": "6.12.69",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.15.6",
"lessThan": "6.16",
"versionType": "semver"
}
],
"programFiles": [
"drivers/nvme/target/io-cmd-bdev.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.69",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.9",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/nvme/target/io-cmd-bdev.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-23148
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #39770 · Revision 1
- Added to Heist Feed
- Publisher date