Linux kernel NVMe: SUBMIT_IO skips the command permission check, allowing writes through read-only handles

Impact

Unlike NVME_IOCTL_IO_CMD and IO64_CMD, NVME_IOCTL_SUBMIT_IO never called nvme_cmd_allowed(), so an unprivileged caller holding a device handle could issue I/O against a partition device or write through a file descriptor opened read-only. That is a direct storage integrity and confidentiality break: the check that normally confines partition-scoped and read-only handles is simply absent on that path. On a GPU node this is the local NVMe that holds scratch datasets, container images and model checkpoints, often carved into partitions shared between tenants or system roles; a tenant with access to one partition handle can read or write outside its intended scope. Remediation is a kernel update, which means draining the node. NVD scores it local, low complexity, high on confidentiality, integrity and availability.

Who can reach it

Local user with an open file descriptor on an NVMe block device or partition, including a read-only one. No administrative privilege is needed beyond that handle - which is exactly the case this fix closes.

What to do

Apply the stable kernel update that passes flags and open_for_write through to nvme_cmd_allowed() and returns -EACCES for disallowed commands (commits 736b7c6adc7a, 95b0591d51db, b116e9dae433, b53d495c7f0d, c35cd98eed1a), then drain and reboot each node. As an interim control, tighten who can open NVMe block devices and do not pass raw NVMe devices or partitions into tenant containers. The record names no fixed release numbers.

References

Related entries

• Linux kernel IOMMU DMA: unlocked msi_page_list corruption with two devices in one VFIO containerCVE-2026-90244 · Linux kernel iommu/dma (MSI page list locking under VFIO type1)High
• Linux kernel RDMA/siw: use-after-free in siw_accept() when the supplied QP is already in RTSCVE-2026-90292 · Linux kernel RDMA/siw (software iWARP, siw_accept() connection endpoint refcount)High
• Linux kernel RDMA/erdma: QP freed while async-event and CM handlers still use itCVE-2026-90308 · Linux kernel RDMA/erdma (QP lookup refcounting in AE and iWARP CM paths)High
• Linux kernel RDMA/erdma: completion queue freed while an in-flight EQ handler still references itCVE-2026-90309 · Linux kernel RDMA/erdma (CQ refcounting in EQ event handlers)High
• Linux kernel BPF verifier: load-acquire into its own source register yields pointer type confusionCVE-2026-90312 · Linux kernel BPF verifier (check_atomic_load source pointer type validation)High
• Linux kernel BPF verifier: kptrs stay valid after the final spin unlock ends RCU protectionCVE-2026-90317 · Linux kernel BPF verifier (RCU pointer validity after final bpf_spin_unlock)High