CVE-2023-6536 Kernel: null pointer dereference in __nvmet_req_complete

What is CVE-2023-6536?

CVE-2023-6536 is a medium-severity vulnerability in Debian Debian Linux, published on 7 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.

Weakness: CWE-476

Which versions are affected by CVE-2023-6536?

It affects 17 products.

Products include Debian Debian Linux, Linux kernel, Redhat Codeready Linux Builder Eus, Redhat Codeready Linux Builder Eus for Power Little Endian Eus, Redhat Codeready Linux Builder for Arm64 Eus, Redhat Codeready Linux Builder for Ibm Z Systems Eus and 11 more.

How do I fix CVE-2023-6536?

Apply the vendor's patch.

Is CVE-2023-6536 being exploited?

There is no known exploitation of CVE-2023-6536 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-6536, GHSA-xw3g-x45j-xxhh, UBUNTU-CVE-2023-6536.