CVE-2026-23148: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23148 is a race condition vulnerability in the Linux kernel's NVMe target (nvmet) subsystem that leads to a NULL pointer dereference in blk_cgroup_bio_start(). The flaw exists in the nvmet_bio_done() function, where improper ordering of cleanup and completion callbacks allows a re-submitted bio to reference a NULL bi_blkg pointer, causing a kernel panic. It was published on February 14, 2026, with patches released on March 17, 2026. Affected kernel versions include 6.12.37–6.12.68, 6.15.6–6.15.x, 6.16.x–6.18.8, and 6.19-rc1 through rc7. The CVSS v3.1 base score is 5.5 (Medium) (Feedly).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference) and stems from a race condition in nvmet_bio_done(). The flawed execution order is: (1) nvmet_bio_done() is called on bio completion; (2) nvmet_req_complete() is invoked, which can re-queue and re-submit the same request reusing the same inline_bio; (3) concurrently, nvmet_req_bio_put() calls bio_uninit() on the inline_bio, setting bio->bi_blkg to NULL; (4) the re-submitted bio enters submit_bio_noacct_nocheck(), where blk_cgroup_bio_start() dereferences the now-NULL bi_blkg, triggering a kernel crash. The fix reorders the calls so nvmet_req_bio_put() is invoked before nvmet_req_complete(), ensuring bio cleanup precedes any possible re-submission (Feedly, Kernel Patch 1).

Successful exploitation causes a kernel NULL pointer dereference (BUG: kernel NULL pointer dereference, address: 0x0000000000000028) in blk_cgroup_bio_start(), resulting in a kernel panic and full system crash. The impact is limited to availability — there is no confidentiality or integrity compromise. The crash can be triggered by local users with low privileges on systems running NVMe target block device services, making it a denial-of-service risk for storage servers or hypervisors exposing NVMe-oF targets (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG: kernel NULL pointer dereference, address: 0000000000000028 with a call trace including blk_cgroup_bio_start, submit_bio_noacct_nocheck, nvmet_bdev_execute_rw, and process_one_work.
• System Behavior: Unexpected kernel panic or system reboot on hosts running NVMe target services during block device read/write operations.
• Process: Abnormal termination or crash of NVMe target worker threads (worker_thread) visible in system logs prior to a reboot (Feedly).

Apply the upstream kernel patches that reorder nvmet_bio_done() to call nvmet_req_bio_put() before nvmet_req_complete(). Specific patched versions to target are: kernel 6.12.69 or later (for 6.12.x branch), 6.16 final release or later (for 6.15.6–6.15.x), and 6.18.9 or later (for 6.16.1–6.18.8 and 6.19-rc series). Patches are available at the upstream stable kernel repository. As a temporary workaround, disabling NVMe target (nvmet) services on systems where they are not required reduces exposure (Feedly, Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).