CVE-2026-23148High· 7.5▾ Twilight

nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference There is a race condition in nvmet_bio_done() that can cause a NULL pointer dereference in blk_…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Feb 14, 2026

Updated

Oct 19, 2026

CVSS

7.5

Vendor

Linux

Product

Linux

CWE

—

Depth score

41 · Moderate

EPSS

0.30% · p23

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: yes
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 16.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 247 days

Feb 14, 2026Published
Disclosed via CVEORG
Oct 16, 2026EPSS first tracked
0.3%
Oct 19, 2026Record revised
Last analysed / modified upstream

Linux #cve.org

Affected

Linux >= 431e58d56fcb5ff1f9eb630724a922e0d2a941df < ee10b06980acca1d46e0fa36d6fb4a9578eab6e4
Linux >= 190f4c2c863af7cc5bb354b70e0805f06419c038 < 68207ceefd71cc74ce4e983fa9bd10c3122e349b
Linux >= 190f4c2c863af7cc5bb354b70e0805f06419c038 < 0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e
Linux 2e2028fcf924d1c6df017033c8d6e28b735a0508
Linux >= 6.12.37 < 6.12.69
Linux >= 6.15.6 < 6.16
Linux 6.16

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference

There is a race condition in nvmet_bio_done() that can cause a NULL pointer dereference in blk_cgroup_bio_start():

nvmet_bio_done() is called when a bio completes
nvmet_req_complete() is called, which invokes req->ops->queue_response(req)
The queue_response callback can re-queue and re-submit the same request
The re-submission reuses the same inline_bio from nvmet_req
Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete) invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL
The re-submitted bio enters submit_bio_noacct_nocheck()
blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash:

BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode RIP: 0010:blk_cgroup_bio_start+0x10/0xd0 Call Trace: submit_bio_noacct_nocheck+0x44/0x250 nvmet_bdev_execute_rw+0x254/0x370 [nvmet] process_one_work+0x193/0x3c0 worker_thread+0x281/0x3a0

Fix this by reordering nvmet_bio_done() to call nvmet_req_bio_put() BEFORE nvmet_req_complete(). This ensures the bio is cleaned up before the request can be re-submitted, preventing the race condition.

Affected

Linux >= 431e58d56fcb5ff1f9eb630724a922e0d2a941df < ee10b06980acca1d46e0fa36d6fb4a9578eab6e4
Linux >= 190f4c2c863af7cc5bb354b70e0805f06419c038 < 68207ceefd71cc74ce4e983fa9bd10c3122e349b
Linux >= 190f4c2c863af7cc5bb354b70e0805f06419c038 < 0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e
Linux 2e2028fcf924d1c6df017033c8d6e28b735a0508
Linux >= 6.12.37 < 6.12.69
Linux >= 6.15.6 < 6.16
Linux 6.16

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference

There is a race condition in nvmet_bio_done() that can cause a NULL pointer dereference in blk_cgroup_bio_start():

nvmet_bio_done() is called when a bio completes

nvmet_req_complete() is called, which invokes req->ops->queue_response(req)

The queue_response callback can re-queue and re-submit the same request

The re-submission reuses the same inline_bio from nvmet_req

Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete) invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL

The re-submitted bio enters submit_bio_noacct_nocheck()

blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash:

Affected

Linux >= 431e58d56fcb5ff1f9eb630724a922e0d2a941df < ee10b06980acca1d46e0fa36d6fb4a9578eab6e4

Linux >= 190f4c2c863af7cc5bb354b70e0805f06419c038 < 68207ceefd71cc74ce4e983fa9bd10c3122e349b

Linux >= 190f4c2c863af7cc5bb354b70e0805f06419c038 < 0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e

Linux 2e2028fcf924d1c6df017033c8d6e28b735a0508

Linux >= 6.12.37 < 6.12.69

Linux >= 6.15.6 < 6.16

Linux 6.16