CVE-2026-63890 (GCVE-0-2026-63890)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-07-19 14:55
VLAI
Title
scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker drivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the descriptor cursor by an attacker-supplied fip_dlen without ever requiring dlen >= sizeof(struct fip_desc) in the default branch. The named descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked their per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor (fip_dtype >= 128, which the standard requires receivers to silently ignore) skipped that check entirely. An unauthenticated L2 peer on the FCoE control VLAN could hang fcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitely by emitting one FIP CVL frame whose single descriptor had fip_dtype == FIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytes per iteration and the loop condition rlen >= sizeof(*desc) stayed true forever, blocking every subsequent FIP frame on that controller. Tighten the outer dlen guard to also reject dlen < sizeof(struct fip_desc), so a malformed descriptor whose length cannot even cover the descriptor header is rejected before the switch. This is the same lower-bound the named cases already apply and is the minimum scope that closes the loop.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 97c8389d54b9665c38105ea72a428a44b97ff2f6 , < d179949d2175d2857d1c3a275a22bea58bcc5d36 (git)
Affected: 97c8389d54b9665c38105ea72a428a44b97ff2f6 , < fda976f7390bb5d1e9b84ef11ebb17323038e0c6 (git)
Affected: 97c8389d54b9665c38105ea72a428a44b97ff2f6 , < 80a0cd307205236ca28aa49bc553f58edcb9bf3a (git)
Affected: 97c8389d54b9665c38105ea72a428a44b97ff2f6 , < 0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a (git)
Affected: 97c8389d54b9665c38105ea72a428a44b97ff2f6 , < 549859a1131052b07dff11a448e9f3221a40f260 (git)
Affected: 97c8389d54b9665c38105ea72a428a44b97ff2f6 , < 14dd80a20a72ce334adcc2d67402360527065948 (git)
Affected: 97c8389d54b9665c38105ea72a428a44b97ff2f6 , < d537d29d51c8b808469e5adacf3e5a0092700738 (git)
Affected: 97c8389d54b9665c38105ea72a428a44b97ff2f6 , < 9eed1bd59937e6828b00d2f2dfef631d964f3636 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/fcoe/fcoe_ctlr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d179949d2175d2857d1c3a275a22bea58bcc5d36",
              "status": "affected",
              "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
              "versionType": "git"
            },
            {
              "lessThan": "fda976f7390bb5d1e9b84ef11ebb17323038e0c6",
              "status": "affected",
              "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
              "versionType": "git"
            },
            {
              "lessThan": "80a0cd307205236ca28aa49bc553f58edcb9bf3a",
              "status": "affected",
              "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
              "versionType": "git"
            },
            {
              "lessThan": "0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a",
              "status": "affected",
              "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
              "versionType": "git"
            },
            {
              "lessThan": "549859a1131052b07dff11a448e9f3221a40f260",
              "status": "affected",
              "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
              "versionType": "git"
            },
            {
              "lessThan": "14dd80a20a72ce334adcc2d67402360527065948",
              "status": "affected",
              "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
              "versionType": "git"
            },
            {
              "lessThan": "d537d29d51c8b808469e5adacf3e5a0092700738",
              "status": "affected",
              "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
              "versionType": "git"
            },
            {
              "lessThan": "9eed1bd59937e6828b00d2f2dfef631d964f3636",
              "status": "affected",
              "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/fcoe/fcoe_ctlr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker\n\ndrivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the\ndescriptor cursor by an attacker-supplied fip_dlen without ever\nrequiring dlen \u003e= sizeof(struct fip_desc) in the default branch.  The\nnamed descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked\ntheir per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor\n(fip_dtype \u003e= 128, which the standard requires receivers to silently\nignore) skipped that check entirely.\n\nAn unauthenticated L2 peer on the FCoE control VLAN could hang\nfcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitely\nby emitting one FIP CVL frame whose single descriptor had fip_dtype ==\nFIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytes\nper iteration and the loop condition rlen \u003e= sizeof(*desc) stayed true\nforever, blocking every subsequent FIP frame on that controller.\n\nTighten the outer dlen guard to also reject dlen \u003c sizeof(struct\nfip_desc), so a malformed descriptor whose length cannot even cover the\ndescriptor header is rejected before the switch.  This is the same\nlower-bound the named cases already apply and is the minimum scope that\ncloses the loop."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T14:55:02.195Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d179949d2175d2857d1c3a275a22bea58bcc5d36"
        },
        {
          "url": "https://git.kernel.org/stable/c/fda976f7390bb5d1e9b84ef11ebb17323038e0c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/80a0cd307205236ca28aa49bc553f58edcb9bf3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a"
        },
        {
          "url": "https://git.kernel.org/stable/c/549859a1131052b07dff11a448e9f3221a40f260"
        },
        {
          "url": "https://git.kernel.org/stable/c/14dd80a20a72ce334adcc2d67402360527065948"
        },
        {
          "url": "https://git.kernel.org/stable/c/d537d29d51c8b808469e5adacf3e5a0092700738"
        },
        {
          "url": "https://git.kernel.org/stable/c/9eed1bd59937e6828b00d2f2dfef631d964f3636"
        }
      ],
      "title": "scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63890",
    "datePublished": "2026-07-19T14:55:02.195Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-07-19T14:55:02.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63890",
      "date": "2026-09-20",
      "epss": "0.0022",
      "percentile": "0.12734"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/fcoe/fcoe_ctlr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d179949d2175d2857d1c3a275a22bea58bcc5d36",
                    "status": "affected",
                    "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fda976f7390bb5d1e9b84ef11ebb17323038e0c6",
                    "status": "affected",
                    "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "80a0cd307205236ca28aa49bc553f58edcb9bf3a",
                    "status": "affected",
                    "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a",
                    "status": "affected",
                    "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "549859a1131052b07dff11a448e9f3221a40f260",
                    "status": "affected",
                    "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "14dd80a20a72ce334adcc2d67402360527065948",
                    "status": "affected",
                    "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d537d29d51c8b808469e5adacf3e5a0092700738",
                    "status": "affected",
                    "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9eed1bd59937e6828b00d2f2dfef631d964f3636",
                    "status": "affected",
                    "version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/fcoe/fcoe_ctlr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.30"
                  },
                  {
                    "lessThan": "2.6.30",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker\n\ndrivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the\ndescriptor cursor by an attacker-supplied fip_dlen without ever\nrequiring dlen \u003e= sizeof(struct fip_desc) in the default branch.  The\nnamed descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked\ntheir per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor\n(fip_dtype \u003e= 128, which the standard requires receivers to silently\nignore) skipped that check entirely.\n\nAn unauthenticated L2 peer on the FCoE control VLAN could hang\nfcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitely\nby emitting one FIP CVL frame whose single descriptor had fip_dtype ==\nFIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytes\nper iteration and the loop condition rlen \u003e= sizeof(*desc) stayed true\nforever, blocking every subsequent FIP frame on that controller.\n\nTighten the outer dlen guard to also reject dlen \u003c sizeof(struct\nfip_desc), so a malformed descriptor whose length cannot even cover the\ndescriptor header is rejected before the switch.  This is the same\nlower-bound the named cases already apply and is the minimum scope that\ncloses the loop."
          }
        ],
        "id": "CVE-2026-63890",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {},
        "published": "2026-07-19T16:17:06.300",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/14dd80a20a72ce334adcc2d67402360527065948"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/549859a1131052b07dff11a448e9f3221a40f260"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/80a0cd307205236ca28aa49bc553f58edcb9bf3a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9eed1bd59937e6828b00d2f2dfef631d964f3636"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d179949d2175d2857d1c3a275a22bea58bcc5d36"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d537d29d51c8b808469e5adacf3e5a0092700738"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fda976f7390bb5d1e9b84ef11ebb17323038e0c6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-07T13:42:45+00:00",
      "cve": "CVE-2026-63890",
      "id": "CVE-2026-63890",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63890.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:58:22Z",
      "cve": "CVE-2026-63890",
      "id": "CVE-2026-63890",
      "initial_release_date": "2026-07-21T13:04:09Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "374",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63890",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63890.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.