Riskcovery

CVE-2026-90227

nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

State
Published
Severity
7.8 High
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor.

Pass flags and open_for_write through and reject disallowed commands with -EACCES.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • a53295b6998f62d961c29e54051c1cf1d738c2b3 to before c35cd98eed1a863e8dd51073953563cd8c907f68Affected
  • a53295b6998f62d961c29e54051c1cf1d738c2b3 to before 95b0591d51dbf9e618d7845883d535e88ad7c8afAffected
  • a53295b6998f62d961c29e54051c1cf1d738c2b3 to before 736b7c6adc7a65c4411beff197b6a634f7a6ca27Affected
  • a53295b6998f62d961c29e54051c1cf1d738c2b3 to before b116e9dae433ff631f94c36c61a7a78fe400ed1eAffected
  • a53295b6998f62d961c29e54051c1cf1d738c2b3 to before b53d495c7f0db46b6748b5ade48371a10dd5d3bcAffected
LinuxLinux
  • 3.3Affected
  • before 3.3Not affected
  • 6.6.157 through 6.6.*Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.