HIGH
nvmet Bio Race
CVE-2026-23148
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference There is a race condition in nvmet_bio_done() that can cause a NULL pointer dereference in blk_cgroup_bio_start(): 1. nvmet_bio_done() is called when a bio completes 2. nvmet_req_complete() is called, which invokes req->ops->queue_response(req) 3. The queue_response callback can re-queue and re-submit the same request 4. The re-submission reuses the same inline_bio from nvmet_req 5. Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete) invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL 6. The re-submitted bio enters submit_bio_noacct_nocheck() 7. blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash: BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode RIP: 0010:blk_cgroup_bio_start+0x10/0xd0 Call Trace: submit_bio_noacct_nocheck+0x44/0x250 nvmet_bdev_execute_rw+0x254/0x370 [nvmet] process_one_work+0x193/0x3c0 worker_thread+0x281/0x3a0 Fix this by reordering nvmet_bio_done() to call nvmet_req_bio_put() BEFORE nvmet_req_complete(). This ensures the bio is cleaned up before the request can be re-submitted, preventing the race condition.
02KernelScan AI Analysis
Risk summary
A race condition in the NVMe target subsystem can cause kernel crashes through NULL pointer dereference when bio completion races with request re-submission. This affects systems running NVMe-over-Fabrics targets and can lead to denial of service through kernel panics during normal storage operations.
Vulnerability analysis
Root Cause: A race condition exists in nvmet_bio_done() where nvmet_req_complete() can trigger request re-submission that reuses the same inline_bio while nvmet_req_bio_put() (called after completion) invokes bio_uninit() which sets bio->bi_blkg to NULL. This creates a window where the re-submitted bio has a NULL bi_blkg pointer.
Attack Surface: This affects NVMe-over-Fabrics target implementations where bio completion and request re-submission can race. The vulnerability requires an active NVMe target with block device backend processing I/O requests. It's triggered through normal NVMe command processing, not requiring special privileges beyond the ability to submit NVMe commands to the target.
Fix Mechanism: The patch reorders the function calls in nvmet_bio_done() to call nvmet_req_bio_put() BEFORE nvmet_req_complete(). This ensures the bio is properly cleaned up before the request completion callback can potentially re-queue and re-submit the request, eliminating the race window. The bio status is captured in a local variable to preserve it across the reordering.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.12 | 6.12.69 | ee10b06980ac |
| 6.16 | 6.16 | 68207ceefd71 |
| 6.18 | 6.18.9 | 0fcee2cfc4b2 |
| mainline | 6.19 | — |