Executive brief
A vulnerability in the Linux kernel's Fibre Channel over Ethernet (FCoE) component could allow an attacker on the same local network to cause a denial-of-service condition. By sending a specially crafted network frame, an attacker can cause the system's storage controller to hang indefinitely. This would result in a loss of access to network-attached storage, potentially disrupting business operations and data availability.
Technical details
A vulnerability exists in drivers/scsi/fcoe/fcoe_ctlr.c within the fcoe_ctlr_recv_clr_vlink() function. The 'CVL walker' loop fails to validate the length of FIP (FCoE Initialization Protocol) descriptors, specifically allowing a fip_dlen of zero for non-critical descriptors (fip_dtype >= 128). An unauthenticated attacker on the same L2 FCoE control VLAN can send a FIP CVL frame with a zero-length descriptor, causing the cursor to never advance while the remaining length condition remains true. This results in an infinite loop in fcoe_ctlr_recv_work, effectively hanging the FCoE initiator and blocking all subsequent FIP traffic. The issue has been resolved by enforcing a minimum descriptor length check.
Affected products
- Linux Linux Kernel 97c8389d54b9665c38105ea72a428a44b97ff2f6 to d179949d2175d2857d1c3a275a22bea58bcc5d36
Timeline
- 2026-05-18: other: Vulnerability fixed in source code
- 2026-06-19: patched: Patch committed to stable tree
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a
- https://git.kernel.org/stable/c/14dd80a20a72ce334adcc2d67402360527065948
- https://git.kernel.org/stable/c/549859a1131052b07dff11a448e9f3221a40f260
- https://git.kernel.org/stable/c/80a0cd307205236ca28aa49bc553f58edcb9bf3a
- https://git.kernel.org/stable/c/9eed1bd59937e6828b00d2f2dfef631d964f3636
- https://git.kernel.org/stable/c/d179949d2175d2857d1c3a275a22bea58bcc5d36
- https://git.kernel.org/stable/c/d537d29d51c8b808469e5adacf3e5a0092700738