CVE-2026-90227

CVE-2026-90227

High · published September 17, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls

nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a

partition device or write through a read-only file descriptor.

Pass flags and open_for_write through and reject disallowed commands

with -EACCES.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.8th percentile
Published
2026-09-17T21:17Z
References (5)
https://git.kernel.org/stable/c/736b7c6adc7a65c4411beff197b6a634f7a6ca27 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/95b0591d51dbf9e618d7845883d535e88ad7c8af · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b116e9dae433ff631f94c36c61a7a78fe400ed1e · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c35cd98eed1a863e8dd51073953563cd8c907f68 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:07Z
    nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
    cvelistv5