CVE-2026-63889 (GCVE-0-2026-63889)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:36
VLAI
EPSS
VEX
Title
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS
frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in
the generic FC transport. This is not a local userspace or IP network
path; the attacker must be able to inject fabric traffic, for example as
a compromised switch or fabric controller, or as a same-zone N_Port on a
fabric that permits source spoofing.
The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop
counter against the 32-bit on-wire pname_count field, and did not bound
pname_count by the descriptor body already validated by the TLV walker.
A pname_count of 256 therefore wraps the counter and keeps the loop
condition true indefinitely.
Factor the shared pname_list[] walk into one helper, widen the counter
to u32, and clamp pname_count against the entries that fit in the
descriptor body before iterating.
Severity
8.1 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < 07776b7779c9426982c1ad74aad91bd531593790
(git)
Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < 29f126f09e34a425b376b3646c89aa7cc18b142c (git) Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < 163bd704d7515c3df6c2e03bcba93d1db79edbff (git) Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < ee57b89e5da9fffbe0d26647e4ff0750dacb9943 (git) Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < 35461d23744175a78b6280293892cca357c22793 (git) Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770 (git) Affected: 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 , < a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153 (git) |
guessed | |
| Linux | Linux |
Affected:
5.11
Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_transport_fc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "07776b7779c9426982c1ad74aad91bd531593790",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "29f126f09e34a425b376b3646c89aa7cc18b142c",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "163bd704d7515c3df6c2e03bcba93d1db79edbff",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "ee57b89e5da9fffbe0d26647e4ff0750dacb9943",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "35461d23744175a78b6280293892cca357c22793",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_transport_fc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_transport_fc: Widen FPIN pname walker counter to u32\n\nAn adjacent Fibre Channel fabric actor that can deliver an FPIN ELS\nframe to an lpfc or qla2xxx Linux initiator can trigger a non-return in\nthe generic FC transport. This is not a local userspace or IP network\npath; the attacker must be able to inject fabric traffic, for example as\na compromised switch or fabric controller, or as a same-zone N_Port on a\nfabric that permits source spoofing.\n\nThe Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop\ncounter against the 32-bit on-wire pname_count field, and did not bound\npname_count by the descriptor body already validated by the TLV walker.\nA pname_count of 256 therefore wraps the counter and keeps the loop\ncondition true indefinitely.\n\nFactor the shared pname_list[] walk into one helper, widen the counter\nto u32, and clamp pname_count against the entries that fit in the\ndescriptor body before iterating."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Exploitation requires injecting a crafted FPIN ELS frame onto the Fibre Channel fabric from an adjacent fabric actor (compromised switch, fabric controller, or same-zone N_Port), not via IP or local syscalls.\nAC:L - Once on the fabric, an attacker can reliably trigger the bug by sending an FPIN with a Link-Integrity or Peer-Congestion descriptor containing pname_count=256 and a minimally valid TLV length; no race or special memory layout is required.\nPR:N - The attacker needs no privileges on the victim Linux host; FPIN ELS frames are processed without authentication once the HBA has completed fabric discovery.\nUI:N - No victim user action is required; the malicious FPIN is processed automatically when received by the HBA firmware and driver stack.\nS:U - Impact is confined to kernel availability and information disclosure on the affected host; it does not cross a security boundary such as VM escape or sandbox breakout.\nC:H - The unbounded loop reads pname_list[i] beyond the validated descriptor body via out-of-bounds kernel memory reads on every iteration, enabling information disclosure from adjacent kernel memory.\nI:N - The bug causes only counter increments in FPIN statistics structures on matched rports; there is no memory corruption or write primitive that could modify arbitrary data or achieve code execution.\nA:H - The infinite loop pins a CPU in kernel context (potentially from interrupt/DPC paths) and repeatedly acquires host_lock via fc_find_rport_by_wwpn(), causing soft lockup and complete loss of host availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:36:58.639Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/07776b7779c9426982c1ad74aad91bd531593790"
},
{
"url": "https://git.kernel.org/stable/c/29f126f09e34a425b376b3646c89aa7cc18b142c"
},
{
"url": "https://git.kernel.org/stable/c/163bd704d7515c3df6c2e03bcba93d1db79edbff"
},
{
"url": "https://git.kernel.org/stable/c/ee57b89e5da9fffbe0d26647e4ff0750dacb9943"
},
{
"url": "https://git.kernel.org/stable/c/35461d23744175a78b6280293892cca357c22793"
},
{
"url": "https://git.kernel.org/stable/c/bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770"
},
{
"url": "https://git.kernel.org/stable/c/a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153"
}
],
"title": "scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63889",
"datePublished": "2026-07-19T14:55:01.515Z",
"dateReserved": "2026-07-19T07:54:57.018Z",
"dateUpdated": "2026-08-05T12:36:58.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-63889",
"date": "2026-09-24",
"epss": "0.00389",
"percentile": "0.30159"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_transport_fc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "07776b7779c9426982c1ad74aad91bd531593790",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "29f126f09e34a425b376b3646c89aa7cc18b142c",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "163bd704d7515c3df6c2e03bcba93d1db79edbff",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "ee57b89e5da9fffbe0d26647e4ff0750dacb9943",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "35461d23744175a78b6280293892cca357c22793",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
},
{
"lessThan": "a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153",
"status": "affected",
"version": "3dcfe0de5a9752e646a61f4ce513ac059960c7c3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_transport_fc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_transport_fc: Widen FPIN pname walker counter to u32\n\nAn adjacent Fibre Channel fabric actor that can deliver an FPIN ELS\nframe to an lpfc or qla2xxx Linux initiator can trigger a non-return in\nthe generic FC transport. This is not a local userspace or IP network\npath; the attacker must be able to inject fabric traffic, for example as\na compromised switch or fabric controller, or as a same-zone N_Port on a\nfabric that permits source spoofing.\n\nThe Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop\ncounter against the 32-bit on-wire pname_count field, and did not bound\npname_count by the descriptor body already validated by the TLV walker.\nA pname_count of 256 therefore wraps the counter and keeps the loop\ncondition true indefinitely.\n\nFactor the shared pname_list[] walk into one helper, widen the counter\nto u32, and clamp pname_count against the entries that fit in the\ndescriptor body before iterating."
}
],
"id": "CVE-2026-63889",
"lastModified": "2026-07-27T17:44:23.777",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-07-19T16:17:06.163",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/07776b7779c9426982c1ad74aad91bd531593790"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/163bd704d7515c3df6c2e03bcba93d1db79edbff"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/29f126f09e34a425b376b3646c89aa7cc18b142c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/35461d23744175a78b6280293892cca357c22793"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/ee57b89e5da9fffbe0d26647e4ff0750dacb9943"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Awaiting Analysis"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-09-15T11:39:24+00:00",
"cve": "CVE-2026-63889",
"id": "CVE-2026-63889",
"initial_release_date": "2026-07-19T00:00:00+00:00",
"product_status:fixed": "762",
"product_status:known_affected": "36",
"product_status:known_not_affected": "28",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63889.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-19T01:52:08Z",
"cve": "CVE-2026-63889",
"id": "CVE-2026-63889",
"initial_release_date": "2026-07-21T13:04:10Z",
"product_status:known_affected": "586",
"product_status:known_not_affected": "147",
"product_status:recommended": "210",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-63889",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63889.json",
"version": "12"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…