scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport. This is not a local userspace or IP network path; the attacker must be able to inject fabric traffic, for example as a compromised switch or fabric controller, or as a same-zone N_Port on a fabric that permits source spoofing. The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter against the 32-bit on-wire pname_count field, and did not bound pname_count by the descriptor body already validated by the TLV walker. A pname_count of 256 therefore wraps the counter and keeps the loop condition true indefinitely. Factor the shared pname_list[] walk into one helper, widen the counter to u32, and clamp pname_count against the entries that fit in the descriptor body before iterating.
CVE-2026-63889
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-63889
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"lessThan": "07776b7779c9426982c1ad74aad91bd531593790",
"versionType": "git"
},
{
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"lessThan": "29f126f09e34a425b376b3646c89aa7cc18b142c",
"versionType": "git"
},
{
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"lessThan": "163bd704d7515c3df6c2e03bcba93d1db79edbff",
"versionType": "git"
},
{
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"lessThan": "ee57b89e5da9fffbe0d26647e4ff0750dacb9943",
"versionType": "git"
},
{
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"lessThan": "35461d23744175a78b6280293892cca357c22793",
"versionType": "git"
},
{
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"lessThan": "bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770",
"versionType": "git"
},
{
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"lessThan": "a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153",
"versionType": "git"
}
],
"programFiles": [
"drivers/scsi/scsi_transport_fc.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.11",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/scsi/scsi_transport_fc.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-63889
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #40884 · Revision 1
- Added to Heist Feed
- Publisher date