CVE-2026-90227
Received Received - Intake

BaseFortify

Publication date: 2026-09-17

Last updated on: 2026-09-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass flags and open_for_write through and reject disallowed commands with -EACCES.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-17
Last Modified
2026-09-18
Generated
2026-10-10
EPSS Evaluated
2026-10-09
NVD
CVE-2026-90227

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux a53295b6998f62d961c29e54051c1cf1d738c2b3
Linux Linux a53295b6998f62d961c29e54051c1cf1d738c2b3
Linux Linux a53295b6998f62d961c29e54051c1cf1d738c2b3
Linux Linux a53295b6998f62d961c29e54051c1cf1d738c2b3
Linux Linux a53295b6998f62d961c29e54051c1cf1d738c2b3
Linux Linux 3.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
AI Quick Actions have not been generated yet.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90227. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart