scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-63890
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 16:17:06 UTC
Updated2026-07-19 16:17:06 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker drivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the descriptor cursor by an attacker-supplied fip_dlen without ever requiring dlen >= sizeof(struct fip_desc) in the default branch. The named descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked their per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor (fip_dtype >= 128, which the standard requires receivers to silently ignore) skipped that check entirely. An unauthenticated L2 peer on the FCoE control VLAN could hang fcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitely by emitting one FIP CVL frame whose single descriptor had fip_dtype == FIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytes per iteration and the loop condition rlen >= sizeof(*desc) stayed true forever, blocking every subsequent FIP frame on that controller. Tighten the outer dlen guard to also reject dlen < sizeof(struct fip_desc), so a malformed descriptor whose length cannot even cover the descriptor header is rejected before the switch. This is the same lower-bound the named cases already apply and is the minimum scope that closes the loop.

Risk And Classification

EPSS: 0.002100000 probability, percentile 0.113700000 (date 2026-07-20)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 97c8389d54b9665c38105ea72a428a44b97ff2f6 d179949d2175d2857d1c3a275a22bea58bcc5d36 git Not specified
CNA Linux Linux affected 97c8389d54b9665c38105ea72a428a44b97ff2f6 fda976f7390bb5d1e9b84ef11ebb17323038e0c6 git Not specified
CNA Linux Linux affected 97c8389d54b9665c38105ea72a428a44b97ff2f6 80a0cd307205236ca28aa49bc553f58edcb9bf3a git Not specified
CNA Linux Linux affected 97c8389d54b9665c38105ea72a428a44b97ff2f6 0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a git Not specified
CNA Linux Linux affected 97c8389d54b9665c38105ea72a428a44b97ff2f6 549859a1131052b07dff11a448e9f3221a40f260 git Not specified
CNA Linux Linux affected 97c8389d54b9665c38105ea72a428a44b97ff2f6 14dd80a20a72ce334adcc2d67402360527065948 git Not specified
CNA Linux Linux affected 97c8389d54b9665c38105ea72a428a44b97ff2f6 d537d29d51c8b808469e5adacf3e5a0092700738 git Not specified
CNA Linux Linux affected 97c8389d54b9665c38105ea72a428a44b97ff2f6 9eed1bd59937e6828b00d2f2dfef631d964f3636 git Not specified
CNA Linux Linux affected 2.6.30 Not specified
CNA Linux Linux unaffected 2.6.30 semver Not specified
CNA Linux Linux unaffected 5.10.259 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.210 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.176 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.143 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.93 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.35 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.12 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/d537d29d51c8b808469e5adacf3e5a0092700738 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9eed1bd59937e6828b00d2f2dfef631d964f3636 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/549859a1131052b07dff11a448e9f3221a40f260 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/80a0cd307205236ca28aa49bc553f58edcb9bf3a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/14dd80a20a72ce334adcc2d67402360527065948 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d179949d2175d2857d1c3a275a22bea58bcc5d36 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fda976f7390bb5d1e9b84ef11ebb17323038e0c6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report