CVE-2023-6536

What it actually does

Crafted TCP packets over NVMe/TCP trigger a NULL pointer dereference in the Linux kernel NVMe driver, resulting in kernel panic and denial of service.

Why it matters to the business

Systems relying on NVMe over TCP may experience sudden crashes and service interruptions, leading to operational downtime until the kernel is updated.

How an attack unfolds

An attacker sends a sequence of specially crafted TCP packets targeting an NVMe over TCP endpoint; the malformed input reaches the NVMe driver and causes an immediate NULL dereference, crashing the kernel.

How to fix it

Update the Linux kernel to the fixed commit 7bbf3b67cb49d0f8a20e64b7473923041b758211 or later; rebuild and deploy the patched kernel on all affected systems using NVMe over TCP.

How to confirm the fix worked

Verify the running kernel contains commit 7bbf3b67cb49d0f8a20e64b7473923041b758211; test that NVMe over TCP connections remain stable under malformed packet injection.

Typical attack path

1. Identify hosts exposing NVMe over TCP ports
2. Craft and transmit malicious TCP packets to the target NVMe/TCP interface
3. Trigger NULL pointer dereference in the kernel driver
4. Cause kernel panic and denial of service

How to detect it

Review kernel logs for NVMe driver crashes or NULL pointer dereference messages around the time of suspected incidents; correlate with inbound TCP traffic to NVMe ports.

What your security team should do

• Prioritize kernel upgrade to the listed fixed commit on all NVMe/TCP hosts
• Disable NVMe over TCP where not required until patches are applied
• Monitor kernel logs for NVMe-related panics during the remediation window