CVE-2023-6535

What it actually does

Crafted TCP packets over NVMe/TCP trigger a NULL pointer dereference inside the Linux kernel NVMe driver, resulting in immediate kernel panic and denial of service.

Why it matters to the business

Systems using NVMe over TCP experience sudden loss of availability; workloads on Debian 12 and similar Linux distributions become unreachable until the host is rebooted, potentially disrupting storage services and dependent applications.

How an attack unfolds

An unauthenticated attacker reachable over the network sends a sequence of specially crafted TCP packets targeting the NVMe-over-TCP port; the malformed packets reach the NVMe driver and cause a NULL dereference that panics the kernel.

How to fix it

Upgrade the linux package on Debian 12 to version 6.1.98-1 or later; apply the vendor kernel update that corrects the NVMe/TCP handling path and reboot affected systems.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the fixed release, confirm NVMe/TCP functionality remains operational after the update, and test that crafted-packet sequences no longer produce a panic.

Typical attack path

1. Identify hosts exposing NVMe/TCP services
2. Craft and transmit malicious TCP packets to the NVMe target port
3. Trigger NULL pointer dereference in the kernel driver
4. Cause kernel panic and reboot or hang

How to detect it

Review kernel logs for sudden NVMe driver oops or NULL pointer dereference entries around the time of service loss; correlate with inbound TCP traffic to NVMe ports and unexpected host reboots.

What your security team should do

• Apply the linux 6.1.98-1 update to all Debian 12 systems using NVMe over TCP within the next maintenance window
• Disable NVMe/TCP on hosts where it is not required until patches can be applied
• Monitor vendor advisories for additional affected distributions and backported fixes