CVE-2023-6356

What it actually does

Crafted NVMe-over-TCP packets trigger a NULL pointer dereference inside the Linux kernel NVMe driver, resulting in immediate kernel panic and denial of service.

Why it matters to the business

Remote attackers can crash any system exposing NVMe over TCP, causing unplanned downtime and loss of availability for storage services; the issue affects Debian 11 installations and has remained unexploited in the wild for nearly three years with low EPSS.

How an attack unfolds

An unauthenticated attacker sends a sequence of specially crafted TCP packets to an NVMe-over-TCP target; the kernel driver processes the malformed commands, dereferences a NULL pointer, and panics the system.

How to fix it

Upgrade the linux package on Debian 11 to version 5.10.223-1 or later; apply vendor kernel updates that contain the NVMe driver fix; disable NVMe-over-TCP where not required.

How to confirm the fix worked

Confirm the installed linux package version is at least 5.10.223-1; verify absence of the vulnerable NVMe/TCP code path via kernel source or binary analysis; re-test connectivity after upgrade to ensure the driver no longer panics on the crafted packet sequence.

Typical attack path

1. Identify hosts listening on NVMe-over-TCP ports
2. Craft and transmit a sequence of malicious NVMe/TCP packets
3. Trigger NULL pointer dereference in the NVMe driver
4. Cause kernel panic and denial of service

How to detect it

Inspect system logs for kernel oops or panic messages referencing the NVMe driver; correlate with inbound TCP connections to NVMe ports around the time of the crash; review network captures for unusual NVMe/TCP command sequences.

What your security team should do

• Prioritize patching Debian 11 systems that expose NVMe over TCP
• Review network exposure of NVMe/TCP endpoints and apply least-privilege firewall rules
• Monitor for kernel panics on storage servers and correlate with inbound TCP traffic to NVMe ports