PT-2026-61207 · Linux · Linux

CVE-2026-63890

·

Publicado

2026-07-19

·

Atualizado

2026-07-19

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
scsi: fcoe: Reject FIP descriptors with zero fip dlen in CVL walker
drivers/scsi/fcoe/fcoe ctlr.c::fcoe ctlr recv clr vlink() advanced the descriptor cursor by an attacker-supplied fip dlen without ever requiring dlen >= sizeof(struct fip desc) in the default branch. The named descriptor cases (FIP DT MAC, FIP DT NAME, FIP DT VN ID) checked their per-type minimum lengths, but a FIP DT NON CRITICAL descriptor (fip dtype >= 128, which the standard requires receivers to silently ignore) skipped that check entirely.
An unauthenticated L2 peer on the FCoE control VLAN could hang fcoe ctlr recv work on an fcoe, qedf, or bnx2fc initiator indefinitely by emitting one FIP CVL frame whose single descriptor had fip dtype == FIP DT NON CRITICAL and fip dlen == 0: the cursor advanced zero bytes per iteration and the loop condition rlen >= sizeof(*desc) stayed true forever, blocking every subsequent FIP frame on that controller.
Tighten the outer dlen guard to also reject dlen < sizeof(struct fip desc), so a malformed descriptor whose length cannot even cover the descriptor header is rejected before the switch. This is the same lower-bound the named cases already apply and is the minimum scope that closes the loop.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-63890

Produtos afetados

Linux