---
id: CVE-2026-90227
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

  Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls
  nvme_cmd_allowed()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

  Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls
  nvme_cmd_allowed(). Unprivileged callers can thus issue …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a53295b6998f62d961c29e54051c1cf1d738c2b3 <
    c35cd98eed1a863e8dd51073953563cd8c907f68
  - >-
    Linux >= a53295b6998f62d961c29e54051c1cf1d738c2b3 <
    95b0591d51dbf9e618d7845883d535e88ad7c8af
  - >-
    Linux >= a53295b6998f62d961c29e54051c1cf1d738c2b3 <
    736b7c6adc7a65c4411beff197b6a634f7a6ca27
  - >-
    Linux >= a53295b6998f62d961c29e54051c1cf1d738c2b3 <
    b116e9dae433ff631f94c36c61a7a78fe400ed1e
  - >-
    Linux >= a53295b6998f62d961c29e54051c1cf1d738c2b3 <
    b53d495c7f0db46b6748b5ade48371a10dd5d3bc
  - Linux 3.3
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:47.500'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90227'
references:
  - url: 'https://git.kernel.org/stable/c/736b7c6adc7a65c4411beff197b6a634f7a6ca27'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/95b0591d51dbf9e618d7845883d535e88ad7c8af'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b116e9dae433ff631f94c36c61a7a78fe400ed1e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b53d495c7f0db46b6748b5ade48371a10dd5d3bc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c35cd98eed1a863e8dd51073953563cd8c907f68'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00175
epssPercentile: 0.06193
ingestedAt: '2026-09-17T16:21:47.853Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls
nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a
partition device or write through a read-only file descriptor.

Pass flags and open_for_write through and reject disallowed commands
with -EACCES.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.