CVE-2023-6535: Kernel: null pointer dereference in nvmet_tcp_execute_request

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-07 · updated 2026-06-17
Weakness: CWE-476

Description

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.

Affected products

Linux kernel: all versions
RedHat Codeready Linux Builder Eus: 8.6, 9.2
RedHat Codeready Linux Builder Eus For Power Little Endian Eus: 8.6_ppc64le, 9.2_ppc64le
RedHat Codeready Linux Builder For Arm64 Eus: 8.6_aarch64, 9.2_aarch64
RedHat Codeready Linux Builder For Ibm Z Systems Eus: 9.2_s390x
Red Hat Enterprise Linux: 8.0, 9.0
RedHat Enterprise Linux Eus: 8.6, 9.2
RedHat Enterprise Linux For Arm 64 Eus: 8.6_aarch64, 9.2_aarch64
RedHat Enterprise Linux For Ibm Z Systems Eus: 8.6_s390x, 9.2_s390x
RedHat Enterprise Linux For Power Little Endian Eus: 8.6_ppc64le, 9.2_ppc64le
RedHat Enterprise Linux For Real Time: 9.2
RedHat Enterprise Linux For Real Time For Nfv: 9.2
RedHat Enterprise Linux Server Aus: 8.6, 9.2
RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 8.6_ppc64le, 9.2_ppc64le
RedHat Enterprise Linux Server Tus: 8.6
RedHat Virtualization Host: 4.0

References

Get alerted when CVE-2023-6535 or the next vulnerability affects your stack