CVE-2026-63890
Received Received - Intake

Denial of Service in Linux Kernel FCoE FIP Descriptor Handling

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker drivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the descriptor cursor by an attacker-supplied fip_dlen without ever requiring dlen >= sizeof(struct fip_desc) in the default branch. The named descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked their per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor (fip_dtype >= 128, which the standard requires receivers to silently ignore) skipped that check entirely. An unauthenticated L2 peer on the FCoE control VLAN could hang fcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitely by emitting one FIP CVL frame whose single descriptor had fip_dtype == FIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytes per iteration and the loop condition rlen >= sizeof(*desc) stayed true forever, blocking every subsequent FIP frame on that controller. Tighten the outer dlen guard to also reject dlen < sizeof(struct fip_desc), so a malformed descriptor whose length cannot even cover the descriptor header is rejected before the switch. This is the same lower-bound the named cases already apply and is the minimum scope that closes the loop.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63890
EUVD
EUVD-2026-45663

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the FIP descriptor handling within the FCoE (Fibre Channel over Ethernet) control VLAN. An unauthenticated attacker on the same network segment could exploit this by sending a malformed FIP CVL frame with a non-critical descriptor of zero length. This causes the fcoe_ctlr_recv_work function to hang indefinitely, blocking all subsequent FIP frames on the affected controller.

Detection Guidance

This vulnerability affects the Linux kernel's SCSI FCOE driver. Detection requires checking if your system is running a vulnerable kernel version. Use uname -a to check the kernel version. If the kernel version is below the patched version, the system is likely vulnerable. Network detection involves monitoring FCoE control VLAN traffic for malformed FIP CVL frames with fip_dtype == FIP_DT_NON_CRITICAL and fip_dlen == 0.

Impact Analysis

If you use a system with an affected Linux kernel version, an attacker on the same network could cause a denial of service by hanging the FCoE controller. This would prevent normal network operations for FCoE traffic, potentially disrupting storage or network services that rely on this protocol.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it is a denial-of-service issue in the Linux kernel's SCSI FCOE driver. It could disrupt network services but does not involve data breaches or unauthorized access.

Mitigation Strategies

Immediately update the Linux kernel to a patched version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling the FCOE driver or isolating FCoE control VLAN traffic to reduce exposure. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart