Executive brief
A vulnerability in the Linux kernel's Fibre Channel transport layer could allow an attacker on the same storage network to cause a system hang or denial-of-service. By sending specially crafted management frames, a compromised switch or storage device can trigger an infinite loop in the kernel. This would result in the affected server becoming unresponsive, potentially disrupting access to critical data and storage operations.
Technical details
An infinite loop vulnerability exists in the Linux kernel's scsi_transport_fc component due to an integer truncation/wrap-around. The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter to iterate over a 32-bit on-wire 'pname_count' field. If an attacker provides a 'pname_count' of 256 or greater, the u8 counter wraps back to zero, causing the loop condition to remain true indefinitely. This can be triggered by an adjacent Fibre Channel fabric actor (e.g., a compromised switch or a spoofed N_Port) delivering a malicious FPIN ELS frame to an lpfc or qla2xxx initiator. The fix involves widening the counter to u32 and clamping the count against the validated descriptor body size.
Affected products
- Linux Linux Kernel 5.11 to 7.1.y (fixed in various stable branches)
Timeline
- 2026-05-20: other: Vulnerability reported and patch authored
- 2026-06-19: patched: Patch committed to stable trees
- 2026-07-19: disclosed: CVE-2026-63889 published
References
- https://git.kernel.org/stable/c/07776b7779c9426982c1ad74aad91bd531593790
- https://git.kernel.org/stable/c/163bd704d7515c3df6c2e03bcba93d1db79edbff
- https://git.kernel.org/stable/c/29f126f09e34a425b376b3646c89aa7cc18b142c
- https://git.kernel.org/stable/c/35461d23744175a78b6280293892cca357c22793
- https://git.kernel.org/stable/c/a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153
- https://git.kernel.org/stable/c/bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770
- https://git.kernel.org/stable/c/ee57b89e5da9fffbe0d26647e4ff0750dacb9943