CVE-2023-6238
kernel: nvme: memory corruption via unprivileged user passthrough
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 13, 2023
Updated · October 27, 2026
Description
A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes and memory corruption.
Statement
This CVE has been rated as having a security impact of Low because it requires changing the device node permissions, which are restricted to root only by default.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')