HIGH Introduced in 3.3
nvme SubmitIO Bypass
CVE-2026-90227
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass flags and open_for_write through and reject disallowed commands with -EACCES.
02KernelScan AI Analysis
Risk summary
A local unprivileged user with access to an NVMe device node can bypass permission checks and issue I/O commands that should be restricted, including writing through read-only file descriptors and performing I/O on partition devices. This can lead to unauthorized data disclosure, data corruption, and system instability. Systems that expose NVMe device nodes to untrusted users or container workloads are at highest risk.
Vulnerability analysis
The NVMe ioctl interface is missing a permission check in the submit-I/O path. While other ioctl paths verify that the caller is authorized before proceeding, the submit-I/O path skips this validation. This allows an unprivileged process with an open file descriptor to an NVMe device to issue I/O commands that should be blocked — for example, writing data through a read-only file descriptor or performing I/O on a partition device that should be restricted. The fix adds the same permission check used by the other paths, blocking unauthorized commands before any I/O is submitted. Any local user who can open the NVMe device node can trigger this; no special kernel privileges or hardware configuration are needed beyond having the device file descriptor.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 3.3 | 7.2.6 | b116e9dae433 |
| mainline | 3.3 | 7.3-rc1 | b53d495c7f0d |
| 6.18 | 3.3 | 6.18.52 | 736b7c6adc7a |
| 6.12 | 3.3 | 6.12.110 | 95b0591d51db |
| 6.6 | 3.3 | 6.6.157 | c35cd98eed1a |
| cip/6.12 | 3.3 | 6.12.111-cip32 | 95b0591d51db |