CVE-2026-63890

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker

drivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the

descriptor cursor by an attacker-supplied fip_dlen without ever

requiring dlen >= sizeof(struct fip_desc) in the default branch. The

named descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked

their per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor

(fip_dtype >= 128, which the standard requires receivers to silently

ignore) skipped that check entirely.

An unauthenticated L2 peer on the FCoE control VLAN could hang

fcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitely

by emitting one FIP CVL frame whose single descriptor had fip_dtype ==

FIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytes

per iteration and the loop condition rlen >= sizeof(*desc) stayed true

forever, blocking every subsequent FIP frame on that controller.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References