A vulnerability in the Linux kernel NVMe subsystem allows unprivileged local attackers to bypass read-only file descriptor protections and manipulate partition devices, posing a high risk to system integrity.

The vulnerability exists because the NVME_IOCTL_SUBMIT_IO function fails to invoke the nvme_cmd_allowed function to validate commands. This omission permits an authenticated, low-privileged local user to issue commands that should be restricted, such as writing to read-only file descriptors or interacting with protected partition devices.

The flaw carries a CVSS score of 7.8, indicating a high severity risk. Successful exploitation allows an attacker with local access to compromise the integrity and availability of storage devices, potentially leading to unauthorized data modification, corruption of file systems, or complete loss of data availability. This could result in significant operational disruption and the bypass of established system security controls.

Immediate Action: Update the Linux kernel to version 6.6.157, 6.12.110, 6.18.52, 7.2.6, or newer as provided by your distribution maintainer.

Proactive Monitoring: Review system audit logs for suspicious ioctl calls or unexpected write operations originating from unprivileged user accounts.

Compensating Controls: Restrict local access to the system to only authorized personnel and utilize kernel hardening features like SELinux or AppArmor to enforce mandatory access controls on device nodes.

Public Exploit Available: No (unknown)

Given the potential for unauthorized I/O operations and the high CVSS severity, administrators should prioritize patching the Linux kernel across all affected environments. Ensuring that systems are updated to the latest stable releases is the most effective way to eliminate this vulnerability and prevent potential exploitation by local threat actors.