CVE-2023-6536

HighCVSS 7.5/10Last modified Nov 5, 2026

Description

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—
Red HatRed Hat Virtualization 4 for Red Hat Enterprise Linux 8—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRHOL-5.8-RHEL-9—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 9—

References

Timeline

Published
Feb 7, 2024
Last modified
Nov 5, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-65386.5SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in StCVE-2023-65407.5A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payCVE-2023-65416.1The Allow SVG WordPress plugin before 1.2.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upCVE-2023-65427.1Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself weCVE-2023-65445.4A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hostCVE-2023-65454.7The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redireCVE-2023-65467.0A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONCVE-2023-65475.4Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but nCVE-2023-65488.8Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLICVE-2023-65497.5Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated DenialCVE-2023-65515.4As a simple library, class.upload.php does not perform an in-depth check on uploaded files, allowing a stored XSS vulnerability when the defCVE-2023-65526.1Lack of "current" GET parameter validation during the action of changing a language leads to an open redirect vulnerability.
CVE-2023-6536: High severity, CVSS 7.5 | Vulnix