CVE-2026-90227
High
Description
In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass flags and open_for_write through and reject disallowed commands with -EACCES.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Linux
PublishedSep 17, 2026
First seenSep 17, 2026
How to fix
Update
- Linux Linuxc35cd98eed1a863e8dd51073953563cd8c907f68, 95b0591d51dbf9e618d7845883d535e88ad7c8af, 736b7c6adc7a65c4411beff197b6a634f7a6ca27, b116e9dae433ff631f94c36c61a7a78fe400ed1e, b53d495c7f0db46b6748b5ade48371a10dd5d3bc or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | a53295b6998f62d961c29e54051c1cf1d738c2b3 ≤ v < c35cd98eed1a863e8dd51073953563cd8c907f68, a53295b6998f62d961c29e54051c1cf1d738c2b3 ≤ v < 95b0591d51dbf9e618d7845883d535e88ad7c8af, a53295b6998f62d961c29e54051c1cf1d738c2b3 ≤ v < 736b7c6adc7a65c4411beff197b6a634f7a6ca27, a53295b6998f62d961c29e54051c1cf1d738c2b3 ≤ v < b116e9dae433ff631f94c36c61a7a78fe400ed1e, a53295b6998f62d961c29e54051c1cf1d738c2b3 ≤ v < b53d495c7f0db46b6748b5ade48371a10dd5d3bc, 3.3 | c35cd98eed1a863e8dd51073953563cd8c907f68, 95b0591d51dbf9e618d7845883d535e88ad7c8af, 736b7c6adc7a65c4411beff197b6a634f7a6ca27, b116e9dae433ff631f94c36c61a7a78fe400ed1e, b53d495c7f0db46b6748b5ade48371a10dd5d3bc |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.