PT-2026-61206 · Linux · Linux
CVE-2026-63889
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
8.1
Alta
| Vetor | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi transport fc: Widen FPIN pname walker counter to u32
An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS
frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in
the generic FC transport. This is not a local userspace or IP network
path; the attacker must be able to inject fabric traffic, for example as
a compromised switch or fabric controller, or as a same-zone N Port on a
fabric that permits source spoofing.
The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop
counter against the 32-bit on-wire pname count field, and did not bound
pname count by the descriptor body already validated by the TLV walker.
A pname count of 256 therefore wraps the counter and keeps the loop
condition true indefinitely.
Factor the shared pname list[] walk into one helper, widen the counter
to u32, and clamp pname count against the entries that fit in the
descriptor body before iterating.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux