CVE-2026-63889
Received Received - Intake

Integer Overflow in Linux Kernel FC Transport FPIN Handling

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport. This is not a local userspace or IP network path; the attacker must be able to inject fabric traffic, for example as a compromised switch or fabric controller, or as a same-zone N_Port on a fabric that permits source spoofing. The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter against the 32-bit on-wire pname_count field, and did not bound pname_count by the descriptor body already validated by the TLV walker. A pname_count of 256 therefore wraps the counter and keeps the loop condition true indefinitely. Factor the shared pname_list[] walk into one helper, widen the counter to u32, and clamp pname_count against the entries that fit in the descriptor body before iterating.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63889
EUVD
EUVD-2026-45662

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the SCSI Fibre Channel (FC) transport layer. An attacker with access to inject fabric traffic, such as a compromised switch or fabric controller, can send a malformed FPIN ELS frame to trigger an infinite loop in the FC transport code. This occurs because the loop counter for processing pname fields is only 8 bits (u8), while the on-wire pname_count field is 32 bits. A pname_count of 256 causes the counter to wrap around, making the loop condition always true.

Detection Guidance

This vulnerability requires the ability to inject Fibre Channel fabric traffic, which is not typical for standard network detection. It primarily affects systems using lpfc or qla2xxx drivers. Check if your system uses these drivers with: lsmod | grep -E 'lpfc|qla2xxx'. Monitor for unexpected FPIN ELS frames or fabric anomalies using Fibre Channel diagnostic tools like fcinfo or sfkdump if available.

Impact Analysis

If exploited, this vulnerability could cause a denial of service (DoS) by triggering an infinite loop in the Linux kernel's FC transport layer. This would consume system resources and potentially crash the system. The attack requires the attacker to be on the same Fibre Channel fabric, limiting the scope but making it critical for systems using FC storage.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. It involves a flaw in the Linux kernel's Fibre Channel transport layer that could allow an adjacent attacker to cause a denial of service by triggering an infinite loop. Compliance implications would only arise if this vulnerability led to unauthorized data access or disruption of critical systems, which is not indicated in the provided context.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. If patching is not immediately possible, restrict access to the Fibre Channel fabric by ensuring only trusted switches and devices can communicate. Disable source spoofing on the fabric and monitor for unusual FPIN frames. Update to a kernel version containing the fix once available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63889. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart