CVE-2023-6536: Kernel: null pointer dereference in __nvmet_req_complete

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-07 · updated 2026-06-17
Weakness: CWE-476

Description

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.

Affected products

Debian Linux: 10.0
Linux kernel: from 5.0 before 5.4.268; from 5.5 before 5.10.209; from 5.11 before 5.15.148; from 5.16 before 6.1.75; from 6.2 before 6.6.14; from 6.7 before 6.7.2 — fixed in 5.10.209, 5.15.148, 5.4.268, 6.1.75, 6.6.14, 6.7.2
RedHat Codeready Linux Builder Eus: 8.6, 9.2
RedHat Codeready Linux Builder Eus For Power Little Endian Eus: 8.6_ppc64le, 9.2_ppc64le
RedHat Codeready Linux Builder For Arm64 Eus: 8.6_aarch64, 9.2_aarch64
RedHat Codeready Linux Builder For Ibm Z Systems Eus: 9.2_s390x
Red Hat Enterprise Linux: 8.0, 9.0
RedHat Enterprise Linux Eus: 8.6, 9.2
RedHat Enterprise Linux For Arm 64 Eus: 8.6_aarch64, 9.2_aarch64
RedHat Enterprise Linux For Ibm Z Systems Eus: 8.6_s390x, 9.2_s390x
RedHat Enterprise Linux For Power Little Endian Eus: 8.6_ppc64le, 9.2_ppc64le
RedHat Enterprise Linux For Real Time: 9.2
RedHat Enterprise Linux For Real Time For Nfv: 9.2
RedHat Enterprise Linux Server Aus: 8.6, 9.2
RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 8.6_ppc64le, 9.2_ppc64le
RedHat Enterprise Linux Server Tus: 8.6
RedHat Virtualization Host: 4.0

How to fix

Upgrade to a fixed version: Linux kernel 5.10.209, 5.15.148, 5.4.268, 6.1.75. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-6536 or the next vulnerability affects your stack