CVE-2023-6536 is a medium severity flaw in the Linux kernel NVMe driver. With NVMe over TCP enabled, crafted TCP packets from an unauthenticated sender can cause a NULL pointer dereference and a kernel panic, which is a denial of service. Patch the kernel and reboot.
What's affected
- Component: the Linux kernel NVMe driver, specifically NVMe over TCP.
- Trigger described in the record: crafted TCP packets sent by an unauthenticated actor when NVMe over TCP is in use.
- The record lists Red Hat products (CodeReady Linux Builder EUS 8.6 and 9.2, Virtualization Host 4.0 and others) and links Red Hat errata RHSA-2024:0723, 0724, 0725, 0881, 0897 and 1248.
- The same description appears on three CVE records in this range (CVE-2023-6356, CVE-2023-6535 and CVE-2023-6536). The records do not say how the three differ, so read the Red Hat pages for each one.
The record gives a CVSS 3.1 base score of 6.5 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
This only matters if the host uses NVMe over TCP, either as a target that exports storage or as a host that connects to remote namespaces. Check the running kernel and whether the NVMe TCP module is loaded.
uname -r
lsmod | grep nvme_tcp
rpm -q --changelog kernel | grep -i CVE-2023-6356
If nvme_tcp is not loaded and nothing configures it, the code path is not in use. On Red Hat family systems, compare the installed kernel build with the kernel version named in the linked errata for your release.
What to do now
- Identify servers with NVMe over TCP configured.
- Install the kernel package from your distribution or vendor that covers CVE-2023-6536.
- Reboot, then confirm the running kernel version.
- Keep NVMe over TCP traffic on a dedicated, access controlled network.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-476 (NULL Pointer Dereference): Code uses a pointer that was never set, which normally ends in a crash of the process or, in a kernel, of the whole machine.
A NULL pointer dereference in the kernel is not a quiet failure. The kernel follows a pointer that was never set, and the machine panics. On a storage target, that takes down every workload that depends on those volumes.
The record notes the sender needs no authentication, but the trigger is network traffic to an NVMe over TCP endpoint. Keeping that traffic on a dedicated storage network, and off any untrusted segment, limits who can reach the code.
Quick check
What does a kernel panic mean for services?
The host stops. Anything running on it, or any client depending on its storage, loses service until it restarts.
Where do I find fixed kernel versions?
The record points to Red Hat errata. For other distributions, check the distribution security tracker for CVE-2023-6536.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- Gold entry for CVE-2023-6536
Last reviewed: 19 October 2026.
