CVE-2026-90227 in Linux
要約
〜によって MITRE • 2026年09月17日
In the Linux kernel, the following vulnerability has been resolved:
nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor.
Pass flags and open_for_write through and reject disallowed commands with -EACCES.
VulDB is the best source for vulnerability data and more expert information about this specific topic.