CVE-2026-90227

HighCVSS 7.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor.

Pass flags and open_for_write through and reject disallowed commands with -EACCES.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= a53295b6998f62d961c29e54051c1cf1d738c2b3, < c35cd98eed1a863e8dd51073953563cd8c907f68; >= a53295b6998f62d961c29e54051c1cf1d738c2b3, < 95b0591d51dbf9e618d7845883d535e88ad7c8af; >= a53295b6998f62d961c29e54051c1cf1d738c2b3, < 736b7c6adc7a65c4411beff197b6a634f7a6ca27; >= a53295b6998f62d961c29e54051c1cf1d738c2b3, < b116e9dae433ff631f94c36c61a7a78fe400ed1e; >= a53295b6998f62d961c29e54051c1cf1d738c2b3, < b53d495c7f0db46b6748b5ade48371a10dd5d3bc
LinuxLinux3.3

References

Timeline

Published
Sep 17, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-902287.5In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() CVE-2026-902297.4In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is alloCVE-2026-902309.1In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() nvmet_exeCVE-2026-902318.4In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a CVE-2026-90232In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregisteCVE-2026-90233In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node CVE-2026-902347.5In the Linux kernel, the following vulnerability has been resolved: NFS: Return a delegation the client fails to record When an NFS serverCVE-2026-902359.8In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITECVE-2026-90236In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4_putCVE-2026-902377.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: move custom expectation support to helper OriginallCVE-2026-90238In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error paCVE-2026-90239In the Linux kernel, the following vulnerability has been resolved: media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem
CVE-2026-90227: High severity, CVSS 7.8 | Vulnix