CVE-2026-90227 (GCVE-0-2026-90227)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-09-18 17:53
VLAI
Title
nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass flags and open_for_write through and reject disallowed commands with -EACCES.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a53295b6998f62d961c29e54051c1cf1d738c2b3 , < c35cd98eed1a863e8dd51073953563cd8c907f68 (git)
Affected: a53295b6998f62d961c29e54051c1cf1d738c2b3 , < 95b0591d51dbf9e618d7845883d535e88ad7c8af (git)
Affected: a53295b6998f62d961c29e54051c1cf1d738c2b3 , < 736b7c6adc7a65c4411beff197b6a634f7a6ca27 (git)
Affected: a53295b6998f62d961c29e54051c1cf1d738c2b3 , < b116e9dae433ff631f94c36c61a7a78fe400ed1e (git)
Affected: a53295b6998f62d961c29e54051c1cf1d738c2b3 , < b53d495c7f0db46b6748b5ade48371a10dd5d3bc (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.3
Unaffected: 0 , < 3.3 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c35cd98eed1a863e8dd51073953563cd8c907f68",
              "status": "affected",
              "version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
              "versionType": "git"
            },
            {
              "lessThan": "95b0591d51dbf9e618d7845883d535e88ad7c8af",
              "status": "affected",
              "version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
              "versionType": "git"
            },
            {
              "lessThan": "736b7c6adc7a65c4411beff197b6a634f7a6ca27",
              "status": "affected",
              "version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
              "versionType": "git"
            },
            {
              "lessThan": "b116e9dae433ff631f94c36c61a7a78fe400ed1e",
              "status": "affected",
              "version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
              "versionType": "git"
            },
            {
              "lessThan": "b53d495c7f0db46b6748b5ade48371a10dd5d3bc",
              "status": "affected",
              "version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()\n\nUnlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls\nnvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a\npartition device or write through a read-only file descriptor.\n\nPass flags and open_for_write through and reject disallowed commands\nwith -EACCES."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Attacker-controlled opcode/slba/nblocks enter via copy_from_user of struct nvme_user_io in nvme_submit_io(), reached only through ioctl(NVME_IOCTL_SUBMIT_IO) on an NVMe block or ng* char node (blkdev_ioctl \u2192 nvme_ioctl / nvme_ns_chr_ioctl \u2192 nvme_ns_ioctl). No remote protocol carries that payload.\nAC:L - nvme_submit_io() copies the user nvme_user_io, accepts nvme_cmd_read/write/compare, and submits with the caller-chosen io.slba; there is no race or layout dependency, so the same ioctl reliably performs the I/O.\nPR:L - nvme_open()/nvme_ns_chr_open() impose no capability check, and the vulnerable nvme_submit_io() path never called nvme_cmd_allowed(), the only CAP_SYS_ADMIN gate for partition and read-only-fd I/O. An unprivileged user who can open a partition or O_RDONLY NVMe node can issue the ioctl.\nUI:N - The attacker opens the NVMe node they already control and issues NVME_IOCTL_SUBMIT_IO themselves; no other user must mount media, pass a file, or otherwise act.\nS:U - Skipping nvme_cmd_allowed() lets the caller read and write other LBAs of the same NVMe namespace in the host kernel. That is intra-OS partition/fd-mode bypass, not a VM, IOMMU, or guest-to-host boundary crossing.\nC:H - On a partition bdev, nvme_ioctl() still uses bdev-\u003ebd_disk-\u003eprivate_data (the whole namespace) and nvme_submit_io() programs c.rw.slba from attacker io.slba without adding bd_start_sect, so nvme_cmd_read returns arbitrary namespace LBAs including other partitions.\nI:H - The same path accepts io.opcode=nvme_cmd_write and, because nvme_cmd_allowed() is not called, ignores NVME_IOCTL_PARTITION and !open_for_write, so the attacker can persist writes to any namespace LBA from a partition fd or an O_RDONLY descriptor.\nA:H - Those unscoped nvme_cmd_write commands can overwrite other partitions\u0027 metadata, swap, or the OS image on the same namespace, persistently denying use of the host or co-tenant volumes (the failure mode nvme_cmd_allowed() exists to prevent)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:53.677Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c35cd98eed1a863e8dd51073953563cd8c907f68"
        },
        {
          "url": "https://git.kernel.org/stable/c/95b0591d51dbf9e618d7845883d535e88ad7c8af"
        },
        {
          "url": "https://git.kernel.org/stable/c/736b7c6adc7a65c4411beff197b6a634f7a6ca27"
        },
        {
          "url": "https://git.kernel.org/stable/c/b116e9dae433ff631f94c36c61a7a78fe400ed1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc"
        }
      ],
      "title": "nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90227",
    "datePublished": "2026-09-17T16:07:35.989Z",
    "dateReserved": "2026-09-11T19:38:34.794Z",
    "dateUpdated": "2026-09-18T17:53:53.677Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90227",
      "date": "2026-09-25",
      "epss": "0.00175",
      "percentile": "0.06193"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:29:39.000Z",
      "cve": "CVE-2026-90227",
      "id": "msrc_CVE-2026-90227",
      "initial_release_date": "2026-09-19T01:10:44.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90227.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/host/ioctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c35cd98eed1a863e8dd51073953563cd8c907f68",
                    "status": "affected",
                    "version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "95b0591d51dbf9e618d7845883d535e88ad7c8af",
                    "status": "affected",
                    "version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "736b7c6adc7a65c4411beff197b6a634f7a6ca27",
                    "status": "affected",
                    "version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b116e9dae433ff631f94c36c61a7a78fe400ed1e",
                    "status": "affected",
                    "version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b53d495c7f0db46b6748b5ade48371a10dd5d3bc",
                    "status": "affected",
                    "version": "a53295b6998f62d961c29e54051c1cf1d738c2b3",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/host/ioctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.3"
                  },
                  {
                    "lessThan": "3.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()\n\nUnlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls\nnvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a\npartition device or write through a read-only file descriptor.\n\nPass flags and open_for_write through and reject disallowed commands\nwith -EACCES."
          }
        ],
        "id": "CVE-2026-90227",
        "lastModified": "2026-09-18T18:17:47.500",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:18.400",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/736b7c6adc7a65c4411beff197b6a634f7a6ca27"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/95b0591d51dbf9e618d7845883d535e88ad7c8af"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b116e9dae433ff631f94c36c61a7a78fe400ed1e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c35cd98eed1a863e8dd51073953563cd8c907f68"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.