Junglewise Threat Intelligence

CVE-2026-63890: Linux Kernel infinite loop in FCoE CVL walker

CVE-2026-63890 · Severity: info · CVSS 6.5 · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Fibre Channel over Ethernet (FCoE) component could allow an attacker on the same local network to cause a denial-of-service condition. By sending a specially crafted network frame, an attacker can cause the system's storage controller to hang indefinitely. This would result in a loss of access to network-attached storage, potentially disrupting business operations and data availability.

Technical details

A vulnerability exists in drivers/scsi/fcoe/fcoe_ctlr.c within the fcoe_ctlr_recv_clr_vlink() function. The 'CVL walker' loop fails to validate the length of FIP (FCoE Initialization Protocol) descriptors, specifically allowing a fip_dlen of zero for non-critical descriptors (fip_dtype >= 128). An unauthenticated attacker on the same L2 FCoE control VLAN can send a FIP CVL frame with a zero-length descriptor, causing the cursor to never advance while the remaining length condition remains true. This results in an infinite loop in fcoe_ctlr_recv_work, effectively hanging the FCoE initiator and blocking all subsequent FIP traffic. The issue has been resolved by enforcing a minimum descriptor length check.

Affected products

  • Linux Linux Kernel 97c8389d54b9665c38105ea72a428a44b97ff2f6 to d179949d2175d2857d1c3a275a22bea58bcc5d36

Timeline

  • 2026-05-18: other: Vulnerability fixed in source code
  • 2026-06-19: patched: Patch committed to stable tree
  • 2026-07-19: disclosed: CVE published

References

Related threats