CVE-2026-63889 (GCVE-0-2026-63889)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:36
VLAI
Title
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport. This is not a local userspace or IP network path; the attacker must be able to inject fabric traffic, for example as a compromised switch or fabric controller, or as a same-zone N_Port on a fabric that permits source spoofing. The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter against the 32-bit on-wire pname_count field, and did not bound pname_count by the descriptor body already validated by the TLV walker. A pname_count of 256 therefore wraps the counter and keeps the loop condition true indefinitely. Factor the shared pname_list[] walk into one helper, widen the counter to u32, and clamp pname_count against the entries that fit in the descriptor body before iterating.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < 07776b7779c9426982c1ad74aad91bd531593790 (git)
Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < 29f126f09e34a425b376b3646c89aa7cc18b142c (git)
Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < 163bd704d7515c3df6c2e03bcba93d1db79edbff (git)
Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < ee57b89e5da9fffbe0d26647e4ff0750dacb9943 (git)
Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < 35461d23744175a78b6280293892cca357c22793 (git)
Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770 (git)
Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_transport_fc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "07776b7779c9426982c1ad74aad91bd531593790",
              "status": "affected",
              "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
              "versionType": "git"
            },
            {
              "lessThan": "29f126f09e34a425b376b3646c89aa7cc18b142c",
              "status": "affected",
              "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
              "versionType": "git"
            },
            {
              "lessThan": "163bd704d7515c3df6c2e03bcba93d1db79edbff",
              "status": "affected",
              "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
              "versionType": "git"
            },
            {
              "lessThan": "ee57b89e5da9fffbe0d26647e4ff0750dacb9943",
              "status": "affected",
              "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
              "versionType": "git"
            },
            {
              "lessThan": "35461d23744175a78b6280293892cca357c22793",
              "status": "affected",
              "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
              "versionType": "git"
            },
            {
              "lessThan": "bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770",
              "status": "affected",
              "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
              "versionType": "git"
            },
            {
              "lessThan": "a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153",
              "status": "affected",
              "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_transport_fc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_transport_fc: Widen FPIN pname walker counter to u32\n\nAn adjacent Fibre Channel fabric actor that can deliver an FPIN ELS\nframe to an lpfc or qla2xxx Linux initiator can trigger a non-return in\nthe generic FC transport. This is not a local userspace or IP network\npath; the attacker must be able to inject fabric traffic, for example as\na compromised switch or fabric controller, or as a same-zone N_Port on a\nfabric that permits source spoofing.\n\nThe Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop\ncounter against the 32-bit on-wire pname_count field, and did not bound\npname_count by the descriptor body already validated by the TLV walker.\nA pname_count of 256 therefore wraps the counter and keeps the loop\ncondition true indefinitely.\n\nFactor the shared pname_list[] walk into one helper, widen the counter\nto u32, and clamp pname_count against the entries that fit in the\ndescriptor body before iterating."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Exploitation requires injecting a crafted FPIN ELS frame onto the Fibre Channel fabric from an adjacent fabric actor (compromised switch, fabric controller, or same-zone N_Port), not via IP or local syscalls.\nAC:L - Once on the fabric, an attacker can reliably trigger the bug by sending an FPIN with a Link-Integrity or Peer-Congestion descriptor containing pname_count=256 and a minimally valid TLV length; no race or special memory layout is required.\nPR:N - The attacker needs no privileges on the victim Linux host; FPIN ELS frames are processed without authentication once the HBA has completed fabric discovery.\nUI:N - No victim user action is required; the malicious FPIN is processed automatically when received by the HBA firmware and driver stack.\nS:U - Impact is confined to kernel availability and information disclosure on the affected host; it does not cross a security boundary such as VM escape or sandbox breakout.\nC:H - The unbounded loop reads pname_list[i] beyond the validated descriptor body via out-of-bounds kernel memory reads on every iteration, enabling information disclosure from adjacent kernel memory.\nI:N - The bug causes only counter increments in FPIN statistics structures on matched rports; there is no memory corruption or write primitive that could modify arbitrary data or achieve code execution.\nA:H - The infinite loop pins a CPU in kernel context (potentially from interrupt/DPC paths) and repeatedly acquires host_lock via fc_find_rport_by_wwpn(), causing soft lockup and complete loss of host availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:58.639Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/07776b7779c9426982c1ad74aad91bd531593790"
        },
        {
          "url": "https://git.kernel.org/stable/c/29f126f09e34a425b376b3646c89aa7cc18b142c"
        },
        {
          "url": "https://git.kernel.org/stable/c/163bd704d7515c3df6c2e03bcba93d1db79edbff"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee57b89e5da9fffbe0d26647e4ff0750dacb9943"
        },
        {
          "url": "https://git.kernel.org/stable/c/35461d23744175a78b6280293892cca357c22793"
        },
        {
          "url": "https://git.kernel.org/stable/c/bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153"
        }
      ],
      "title": "scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63889",
    "datePublished": "2026-07-19T14:55:01.515Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-08-05T12:36:58.639Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63889",
      "date": "2026-09-21",
      "epss": "0.00358",
      "percentile": "0.29522"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/scsi_transport_fc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "07776b7779c9426982c1ad74aad91bd531593790",
                    "status": "affected",
                    "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "29f126f09e34a425b376b3646c89aa7cc18b142c",
                    "status": "affected",
                    "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "163bd704d7515c3df6c2e03bcba93d1db79edbff",
                    "status": "affected",
                    "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ee57b89e5da9fffbe0d26647e4ff0750dacb9943",
                    "status": "affected",
                    "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "35461d23744175a78b6280293892cca357c22793",
                    "status": "affected",
                    "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770",
                    "status": "affected",
                    "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153",
                    "status": "affected",
                    "version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/scsi_transport_fc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.11"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_transport_fc: Widen FPIN pname walker counter to u32\n\nAn adjacent Fibre Channel fabric actor that can deliver an FPIN ELS\nframe to an lpfc or qla2xxx Linux initiator can trigger a non-return in\nthe generic FC transport. This is not a local userspace or IP network\npath; the attacker must be able to inject fabric traffic, for example as\na compromised switch or fabric controller, or as a same-zone N_Port on a\nfabric that permits source spoofing.\n\nThe Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop\ncounter against the 32-bit on-wire pname_count field, and did not bound\npname_count by the descriptor body already validated by the TLV walker.\nA pname_count of 256 therefore wraps the counter and keeps the loop\ncondition true indefinitely.\n\nFactor the shared pname_list[] walk into one helper, widen the counter\nto u32, and clamp pname_count against the entries that fit in the\ndescriptor body before iterating."
          }
        ],
        "id": "CVE-2026-63889",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:06.163",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/07776b7779c9426982c1ad74aad91bd531593790"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/163bd704d7515c3df6c2e03bcba93d1db79edbff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/29f126f09e34a425b376b3646c89aa7cc18b142c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/35461d23744175a78b6280293892cca357c22793"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ee57b89e5da9fffbe0d26647e4ff0750dacb9943"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T11:39:24+00:00",
      "cve": "CVE-2026-63889",
      "id": "CVE-2026-63889",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:fixed": "762",
      "product_status:known_affected": "36",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63889.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T01:52:08Z",
      "cve": "CVE-2026-63889",
      "id": "CVE-2026-63889",
      "initial_release_date": "2026-07-21T13:04:10Z",
      "product_status:known_affected": "586",
      "product_status:known_not_affected": "147",
      "product_status:recommended": "210",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63889",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63889.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.