CVE-2026-63889

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An adjacent Fibre Channel fabric actor, such as a compromised switch, fabric controller, or a same-zone N Port capable of source spoofing, can trigger a non-return state in the generic FC transport. This occurs when an FPIN ELS frame is delivered to an lpfc or qla2xxx Linux initiator. The issue stems from the Link-Integrity and Peer-Congestion FPIN walkers using a u8 loop counter against a 32-bit pname count field without bounding the count by the validated descriptor body. Consequently, a pname count value of 256 causes the counter to wrap, resulting in an infinite loop.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.