In the Linux kernel, the following vulnerability has been resolved:

nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls
nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a
partition device or write through a read-only file descriptor.

Pass flags and open_for_write through and reject disallowed commands
with -EACCES.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < c35cd98eed1a863e8dd51073953563cd8c907f68
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 95b0591d51dbf9e618d7845883d535e88ad7c8af
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 736b7c6adc7a65c4411beff197b6a634f7a6ca27
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < b116e9dae433ff631f94c36c61a7a78fe400ed1e
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < b53d495c7f0db46b6748b5ade48371a10dd5d3bc
0 affected < 6.6.157
0 affected < 6.12.110
0 affected < 6.18.52
0 affected < 7.2.6
Linux Linux affected
Version Status Constraints
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.52 unaffected ≤ 6.18.*
7.2.6 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/736b7c6adc7a65c4411beff197b6a634f7a6ca27 cve-icon cve-icon
https://git.kernel.org/stable/c/95b0591d51dbf9e618d7845883d535e88ad7c8af cve-icon cve-icon
https://git.kernel.org/stable/c/b116e9dae433ff631f94c36c61a7a78fe400ed1e cve-icon cve-icon
https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc cve-icon cve-icon
https://git.kernel.org/stable/c/c35cd98eed1a863e8dd51073953563cd8c907f68 cve-icon cve-icon
History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass flags and open_for_write through and reject disallowed commands with -EACCES.
Title nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-17T16:07:35.989Z

Reserved: 2026-09-11T19:38:34.794Z

Link: CVE-2026-90227

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T17:17:18.400

Modified: 2026-09-17T17:17:18.400

Link: CVE-2026-90227

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.