diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index 0647586f..506d3705 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -244,3 +244,11 @@ patch was withdrawn by its author and the affected fs/jfs code is unchanged"
 # The CVE names usb_giveback_urb(), which does not exist; the reporter's PoC
 # and Ubuntu's break-fix data both point at drivers/media/rc/imon.c.
 CVE_STATUS[CVE-2023-4010] = "fixed-version: Fixed from version 6.18"
+
+# The user metadata length is not checked against the length the device
+# derives from the command. The fix was applied to nvme-6.6 and then backed
+# out; nothing has landed since. Kernels before v6.2 predate unprivileged
+# passthrough (855b7717f44b) and are not affected.
+# https://lore.kernel.org/linux-nvme/20231016060519.231880-1-joshi.k@samsung.com/
+CVE_STATUS[CVE-2023-6238] = "unpatched: the proposed fix was applied to \
+nvme-6.6 and then reverted, no upstream fix has landed since"