CVE-2023-6535 is a medium severity Linux kernel flaw in the NVMe driver. Crafted TCP packets sent to a host using NVMe over TCP can cause a NULL pointer dereference, a kernel panic and a denial of service. Install the kernel update from your vendor and reboot.
What's affected
- Component: the Linux kernel NVMe driver, specifically NVMe over TCP.
- Trigger described in the record: crafted TCP packets sent by an unauthenticated actor when NVMe over TCP is in use.
- The record lists Red Hat products (CodeReady Linux Builder EUS 8.6 and 9.2, Virtualization Host 4.0 and others) and links Red Hat errata RHSA-2024:0723, 0724, 0725, 0881, 0897 and 1248.
- The same description appears on three CVE records in this range (CVE-2023-6356, CVE-2023-6535 and CVE-2023-6536). The records do not say how the three differ, so read the Red Hat pages for each one.
The record gives a CVSS 3.1 base score of 6.5 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
This only matters if the host uses NVMe over TCP, either as a target that exports storage or as a host that connects to remote namespaces. Check the running kernel and whether the NVMe TCP module is loaded.
uname -r
lsmod | grep nvme_tcp
rpm -q --changelog kernel | grep -i CVE-2023-6356
If nvme_tcp is not loaded and nothing configures it, the code path is not in use. On Red Hat family systems, compare the installed kernel build with the kernel version named in the linked errata for your release.
What to do now
- List hosts that expose or consume NVMe over TCP storage.
- Apply the vendor kernel update that names CVE-2023-6535, and check the linked Red Hat errata if you run that family.
- Schedule the reboot for each host, starting with storage targets.
- Confirm after the reboot that the running kernel from uname -r matches the patched build.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-476 (NULL Pointer Dereference): Code uses a pointer that was never set, which normally ends in a crash of the process or, in a kernel, of the whole machine.
A NULL pointer dereference in the kernel is not a quiet failure. The kernel follows a pointer that was never set, and the machine panics. On a storage target, that takes down every workload that depends on those volumes.
The record notes the sender needs no authentication, but the trigger is network traffic to an NVMe over TCP endpoint. Keeping that traffic on a dedicated storage network, and off any untrusted segment, limits who can reach the code.
Quick check
Is this the same bug as CVE-2023-6356?
The NVD text is identical, but they are separate CVE IDs. The record does not explain the split, so treat them as separate items to confirm patched.
Can the flaw be reached from the internet?
The record says an unauthenticated actor sends the packets. Reach depends on whether your NVMe over TCP port is exposed, which it should not be.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- Gold entry for CVE-2023-6535
Last reviewed: 19 October 2026.
