Linux kernel (drivers/nvme/target): Ordinary client I/O to an nvmet block-device namespace can hit a completion race

CVSS 7.5CVE-2026-23148Kernel, userspace & hypervisorcurated

Impact

Ordinary client I/O to an nvmet block-device namespace can hit a completion race where the target's inline bio is torn down while the same bio is being re-submitted, dereferencing a NULL cgroup pointer in the block layer. The shared storage node crashes on the normal read/write path, so a single tenant's I/O pattern can knock out the target for all of them.

Who can reach it

Driven by a connected NVMe-oF client's regular I/O against an exported namespace backed by a block device - no special opcode and no privilege on the target side. Any tenant or peer that has been allowed to connect to the subsystem can push the target into the window; it is a timing race, so it favours high-rate I/O rather than a crafted packet. Requires nvmet configured with a bdev-backed namespace.

What to do

Update to 6.12.69 / 6.16 or later. Interim: no clean workaround short of stopping the nvmet subsystem export or moving affected namespaces to a patched node - the path is the normal I/O path, so it cannot be gated by configuration.

References

https://git.kernel.org/stable/c/ee10b06980acca1d46e0fa36d6fb4a9578eab6e4 https://git.kernel.org/stable/c/68207ceefd71cc74ce4e983fa9bd10c3122e349b https://nvd.nist.gov/vuln/detail/CVE-2026-23148

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.