High 7.8Published Sep 17, 2026

CVE-2026-90227nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

Updated under an hour ago (Oct 27, 2026, 5:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass flags and open_for_write through and reject disallowed commands with -EACCES.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a53295b6998f62d961c29e54051c1cf1d738c2b3 before c35cd98eed1a863e8dd51073953563cd8c907f68; from a53295b6998f62d961c29e54051c1cf1d738c2b3 before 95b0591d51dbf9e618d7845883d535e88ad7c8af; from a53295b6998f62d961c29e54051c1cf1d738c2b3 before 736b7c6adc7a65c4411beff197b6a634f7a6ca27; from a53295b6998f62d961c29e54051c1cf1d738c2b3 before b116e9dae433ff631f94c36c61a7a78fe400ed1e; from a53295b6998f62d961c29e54051c1cf1d738c2b3 before b53d495c7f0db46b6748b5ade48371a10dd5d3bc	CNA record

References

References

https://git.kernel.org/stable/c/c35cd98eed1a863e8dd51073953563cd8c907f68
https://git.kernel.org/stable/c/95b0591d51dbf9e618d7845883d535e88ad7c8af
https://git.kernel.org/stable/c/736b7c6adc7a65c4411beff197b6a634f7a6ca27
https://git.kernel.org/stable/c/b116e9dae433ff631f94c36c61a7a78fe400ed1e
https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.