Security readout for executives and security teams
Plain-English summary
CVE-2023-6536 is a Linux kernel denial-of-service flaw in the NVMe over TCP path. If exposed and reachable, crafted TCP traffic can trigger a NULL pointer dereference and crash the kernel, disrupting hosts that depend on affected Red Hat kernel packages.
Executive priority
Treat this as a medium-priority availability risk for storage-facing Linux infrastructure. Prioritize systems using NVMe over TCP or supporting critical workloads, because successful triggering can crash the host rather than merely degrade a service.
Technical view
The flaw is reported in the Linux kernel NVMe driver, specifically __nvmet_req_complete, when NVMe over TCP is in use. Sources describe crafted TCP packets causing a NULL pointer dereference, kernel panic, and availability loss. CVSS 3.1 is 6.5 with network attack vector and high availability impact.
Likely exposure
Exposure is most likely on RHEL 8, RHEL 9, EUS, realtime, NFV, virtualization, or listed RHOL environments using affected kernel or kernel-rt builds and NVMe over TCP. Systems not using NVMe over TCP are less likely to be reachable through this flaw.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of active exploitation. The description says crafted TCP packets are involved when NVMe over TCP is used. CVSS lists PR:L, while the description says unauthenticated, so privilege requirements are not fully clear from the bundle.
Researcher notes
Evidence supports a NULL pointer dereference in the Linux NVMe driver during NVMe over TCP handling. The source bundle does not include exploit code, confirmed exploitation, or detailed fixed-version mapping beyond Red Hat advisory references. The PR:L versus unauthenticated wording conflict should be resolved against vendor advisories during triage.
Mitigation direction
- Apply the relevant Red Hat security errata and kernel updates for affected products.
- Update kernel-rt packages where realtime RHEL variants are deployed.
- Check vendor advisories for exact fixed builds and supported remediation paths.
- Reduce unnecessary NVMe over TCP network reachability until updates are complete.
Validation and detection
- Inventory hosts running affected RHEL, EUS, realtime, NFV, virtualization, or RHOL packages.
- Confirm whether NVMe over TCP is enabled or reachable on those hosts.
- Compare installed kernel package versions against the affected versions in vendor data.
- After patching, verify the running kernel comes from the vendor-corrected advisory stream.
- Review host logs for kernel panic events consistent with NVMe driver crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-6536 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2024:0723CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0724CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0725CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0881CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0897CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1248CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2094CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:3810CVE reference · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-6536CVE reference · vdb-entry, x_refsource_REDHAT
- RHBZ#2254052CVE reference · issue-tracking, x_refsource_REDHAT
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.htmlCVE reference · x_transferred
- https://security.netapp.com/advisory/ntap-20240415-0001/CVE reference · x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFYW6R64GPLUOXSQBJI3JBUX3HGLAYPP/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.