CVE-2026-23148: Add CVSS 3.1 score (7.5 HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AV:N -The nvmet (NVMe target) subsystem is reachable over the
    network via nvmet-tcp on TCP port 4420, allowing a remote NVMe-oF
    initiator to send I/O commands that trigger the vulnerable bio
    completion path.
AC:L -The attacker controls both sides of the race by sending
    concurrent I/O commands at high queue depth over nvmet-tcp; the
    race between bio completion and request re-submission via the
    workqueue is reliably triggerable under load, as confirmed by the
    real crash trace in the commit message.
PR:N -NVMe-oF over TCP does not require authentication by default;
    DH-HMAC-CHAP auth is optional and commonly not configured, and the
    hostnqn in the connect command is an unauthenticated string that
    can be spoofed.
UI:N -No user interaction is required; the attacker autonomously
    sends NVMe I/O commands over the network to trigger the race
    condition.
S:U -The vulnerability crashes the kernel within the same security
    authority; there is no crossing of security boundaries such as VM
    escape or sandbox bypass.
C:N -The immediate impact is a NULL pointer dereference crash; no
    information is disclosed to the attacker as the kernel panics
    without leaking memory contents back over the network.
I:N -The bug results in a kernel crash via NULL dereference, not
    data modification; the bio_uninit zeroing of fields on the live bio
    does not give the attacker a write primitive that could modify
    persistent data.
A:H -The NULL pointer dereference in blk_cgroup_bio_start causes a
    kernel oops/panic, completely crashing the system and denying
    service to all users; this is remotely triggerable and repeatable.

Signed-off-by: Sasha Levin <sashal@kernel.org>