CVE-2026-90227

A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) input/output control (ioctl) handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVME_IOCTL_SUBMIT_IO function. This allows them to perform unauthorized I/O operations on a partition device or write to a read-only file descriptor, potentially leading to privilege escalation or unauthorized data modification.

Red Hat has classified this issue as having an Important severity impact because local users with limited privileges can subvert intended storage access boundaries, enabling arbitrary write actions across underlying drive partitions. On standard Red Hat Enterprise Linux deployments with NVMe storage, users or processes holding minimal read permissions to device nodes can bypass file descriptor restrictions to alter protected data directly. Although exploitation requires existing local system access and interaction with NVMe device interfaces, the potential for unauthorized data alteration and privilege elevation justifies the Important rating over a lower classification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.