CVE-2023-6356 is a medium severity flaw in the Linux kernel NVMe driver. When NVMe over TCP is in use, crafted TCP packets from an unauthenticated sender can trigger a NULL pointer dereference, a kernel panic and a denial of service. The fix arrives as a vendor kernel update.
What's affected
- Component: the Linux kernel NVMe driver, specifically NVMe over TCP.
- Trigger described in the record: crafted TCP packets sent by an unauthenticated actor when NVMe over TCP is in use.
- The record lists Red Hat products (CodeReady Linux Builder EUS 8.6 and 9.2, Virtualization Host 4.0 and others) and links Red Hat errata RHSA-2024:0723, 0724, 0725, 0881, 0897 and 1248.
- The same description appears on three CVE records in this range (CVE-2023-6356, CVE-2023-6535 and CVE-2023-6536). The records do not say how the three differ, so read the Red Hat pages for each one.
The record gives a CVSS 3.1 base score of 6.5 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
This only matters if the host uses NVMe over TCP, either as a target that exports storage or as a host that connects to remote namespaces. Check the running kernel and whether the NVMe TCP module is loaded.
uname -r
lsmod | grep nvme_tcp
rpm -q --changelog kernel | grep -i CVE-2023-6356
If nvme_tcp is not loaded and nothing configures it, the code path is not in use. On Red Hat family systems, compare the installed kernel build with the kernel version named in the linked errata for your release.
What to do now
- Find every host that runs NVMe over TCP, as a target or as a client.
- Install the kernel update from your vendor that lists CVE-2023-6356. For Red Hat family systems, start with the errata linked in the record.
- Reboot into the new kernel. A kernel fix is not active until the host restarts.
- Restrict NVMe over TCP ports to the storage network until patching is complete.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-476 (NULL Pointer Dereference): Code uses a pointer that was never set, which normally ends in a crash of the process or, in a kernel, of the whole machine.
A NULL pointer dereference in the kernel is not a quiet failure. The kernel follows a pointer that was never set, and the machine panics. On a storage target, that takes down every workload that depends on those volumes.
The record notes the sender needs no authentication, but the trigger is network traffic to an NVMe over TCP endpoint. Keeping that traffic on a dedicated storage network, and off any untrusted segment, limits who can reach the code.
Quick check
Do I need to patch hosts that never load nvme_tcp?
The described trigger needs NVMe over TCP in use. Still, patch on your normal kernel schedule, since the update will carry other fixes.
Why do three CVEs share one description?
The record text for CVE-2023-6356, CVE-2023-6535 and CVE-2023-6536 is identical. Check the vendor tracker for each to see how they are tied to kernel code.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- Gold entry for CVE-2023-6356
Last reviewed: 19 October 2026.
