Executive brief
The Linux kernel's NVMe storage driver failed to properly validate permissions for I/O operations submitted through the SUBMIT_IO ioctl interface. This allowed unprivileged users to bypass access controls and perform unauthorized I/O operations on storage partitions or write data through read-only file descriptors, potentially compromising data integrity and system stability.
Technical details
The vulnerability is a privilege escalation and authorization bypass in the NVMe ioctl handler. Unlike other I/O ioctl commands (IO_CMD and IO64_CMD) that invoke nvme_cmd_allowed() to validate permissions, the NVME_IOCTL_SUBMIT_IO code path skipped this check entirely. An unprivileged local attacker could exploit this via ioctl(2) to issue arbitrary I/O commands on partition devices or write through read-only file descriptors. The fix adds permission validation by passing flags and open_for_write parameters to the nvme_submit_io() function and rejecting disallowed commands with -EACCES. The vulnerability is fixed in kernel versions patched after July 2026.
Affected products
- Linux Linux kernel Versions prior to patches from September 2026
Timeline
- 2026-09-17: disclosed: Published by NVD
- 2026-09-14: patched: Patches committed to stable kernel trees
- 2026-07-20: other: Fix authored by Yang Xiuwei