kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...

kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...

kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...

CVE-2026-90227

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...

SUSE CVE-2026-90227

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

DEBIAN-CVE-2026-90227

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

EUVD-2026-81820

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

CVE-2026-90227

This is a local privilege escalation vulnerability in the Linux kernel's nvme/ioctl subsystem. The root cause is that NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed() , unlike the IO_CMD and IO64_CMD ioctl paths. As a result, unprivileged local callers can issue I/O on a partition device or wr...

CVE-2026-90227 nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

CVE-2026-90227: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...