PT-2026-61207 · Linux · Linux
CVE-2026-63890
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
scsi: fcoe: Reject FIP descriptors with zero fip dlen in CVL walker
drivers/scsi/fcoe/fcoe ctlr.c::fcoe ctlr recv clr vlink() advanced the
descriptor cursor by an attacker-supplied fip dlen without ever
requiring dlen >= sizeof(struct fip desc) in the default branch. The
named descriptor cases (FIP DT MAC, FIP DT NAME, FIP DT VN ID) checked
their per-type minimum lengths, but a FIP DT NON CRITICAL descriptor
(fip dtype >= 128, which the standard requires receivers to silently
ignore) skipped that check entirely.
An unauthenticated L2 peer on the FCoE control VLAN could hang
fcoe ctlr recv work on an fcoe, qedf, or bnx2fc initiator indefinitely
by emitting one FIP CVL frame whose single descriptor had fip dtype ==
FIP DT NON CRITICAL and fip dlen == 0: the cursor advanced zero bytes
per iteration and the loop condition rlen >= sizeof(*desc) stayed true
forever, blocking every subsequent FIP frame on that controller.
Tighten the outer dlen guard to also reject dlen < sizeof(struct
fip desc), so a malformed descriptor whose length cannot even cover the
descriptor header is rejected before the switch. This is the same
lower-bound the named cases already apply and is the minimum scope that
closes the loop.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux