CVE-2026-63889: Linux Kernel FC Transport DoS Vulnerability

CVE-2026-63889 Overview

CVE-2026-63889 is a Linux kernel vulnerability in the generic Fibre Channel (FC) transport layer. The flaw resides in scsi_transport_fc where Fabric Performance Impact Notification (FPIN) ELS frame processing uses an undersized loop counter. An adjacent Fibre Channel fabric actor able to deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-terminating loop in kernel context. The condition results in kernel-side denial of service on affected initiators. Exploitation requires the ability to inject fabric traffic, such as from a compromised switch, fabric controller, or a same-zone N_Port on a fabric that permits source spoofing.

Critical Impact
An adjacent attacker on the Fibre Channel fabric can cause an infinite loop inside the SCSI FC transport, resulting in a kernel-level denial of service on the affected Linux initiator.

Affected Products

Linux kernel scsi_transport_fc generic Fibre Channel transport
lpfc driver (Emulex/Broadcom Fibre Channel HBA)
qla2xxx driver (QLogic/Marvell Fibre Channel HBA)

Discovery Timeline

2026-07-19 - CVE-2026-63889 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63889

Vulnerability Analysis

The vulnerability affects the Link-Integrity and Peer-Congestion FPIN descriptor walkers in scsi_transport_fc. Both walkers iterate over the on-wire pname_list[] array using a u8 loop counter. The pname_count field they compare against is a 32-bit value carried in the FPIN Type-Length-Value (TLV) descriptor.

Because the loop counter is narrower than the field it is compared to, a pname_count value of 256 wraps the u8 counter back to zero on each iteration. The loop termination condition never becomes false, and the walker never returns. The kernel thread processing the ELS frame remains stuck inside the FC transport code path.

The walkers also failed to clamp pname_count against the descriptor body length already validated by the enclosing TLV walker. Even without the counter width bug, an oversized pname_count would drive the loop past the validated descriptor bounds. The upstream fix factors the shared pname_list[] walk into a single helper, widens the counter to u32, and clamps pname_count against the number of entries that fit inside the descriptor body before iteration begins.

Root Cause

The root cause is a numeric truncation error combined with missing input validation. A u8 counter is used to iterate against a u32 on-wire field, and pname_count is not bounded by the already-validated descriptor body size. This is a kernel-mode denial of service defect [CWE-835 Loop with Unreachable Exit Condition, CWE-197 Numeric Truncation Error].

Attack Vector

The attack vector is adjacent network — specifically the Fibre Channel fabric, not IP or local userspace. An attacker must be able to deliver a crafted FPIN ELS frame to a Linux initiator running lpfc or qla2xxx. Realistic positions include a compromised FC switch, a rogue fabric controller, or a same-zone N_Port on a fabric that does not prevent source address spoofing. The malicious FPIN descriptor sets pname_count to a value such as 0x100 to force the truncated counter to wrap indefinitely inside the Link-Integrity or Peer-Congestion walker.

No verified proof-of-concept code is publicly available. Technical details are documented in the upstream kernel commits referenced in the Linux stable tree.

Detection Methods for CVE-2026-63889

Indicators of Compromise

Kernel threads associated with lpfc or qla2xxx FPIN handling consuming 100% CPU and failing to make forward progress.
Soft lockup or RCU stall messages in dmesg originating from scsi_transport_fc FPIN descriptor walk functions.
Unexpected or malformed FPIN ELS frames observed on the Fibre Channel fabric with abnormally large pname_count values.

Detection Strategies

Monitor kernel logs for soft lockup, rcu: INFO: rcu_sched self-detected stall, or watchdog: BUG entries referencing fc_fpin_* symbols.
Correlate FC HBA driver events with sudden loss of SCSI I/O throughput on initiators that received FPIN frames.
Track FC switch audit logs for zone changes, new N_Port logins, or ELS frame anomalies preceding initiator hangs.

Monitoring Recommendations

Enable and centralize kernel log collection from all Linux FC initiators, focusing on scsi_transport_fc, lpfc, and qla2xxx subsystems.
Alert on repeated ELS frame errors reported by FC HBA drivers, and on FPIN counters exposed under /sys/class/fc_host/.
Baseline normal FPIN volume per fabric and alert on sudden increases or malformed descriptors reported by switch telemetry.

How to Mitigate CVE-2026-63889

Immediate Actions Required

Apply the upstream kernel patch series to hosts running lpfc or qla2xxx initiators as soon as vendor builds are available.
Audit Fibre Channel zoning to ensure initiators are zoned only with trusted targets, and disable any configuration that permits N_Port source address spoofing.
Restrict switch management access and rotate credentials on FC switches and fabric controllers that can originate ELS traffic.

Patch Information

The fix widens the FPIN pname_list[] walker counter to u32, factors the walk into a shared helper, and clamps pname_count against the entries that fit in the descriptor body. Fixes are available in the mainline and stable trees. See the commits 07776b7779c9, 163bd704d751, 29f126f09e34, 35461d237441, a9a39233ec1f, bdff76dff6ec, and ee57b89e5da9. Rebuild or install the patched kernel from your Linux distribution vendor.

Workarounds

Enforce strict FC zoning so that only known-good targets can send ELS traffic to initiators, reducing exposure to same-zone spoofing.
Isolate untrusted or newly added fabric equipment until switch firmware and initiator kernels are updated.
Where fabric-level FPIN generation can be disabled or filtered upstream, do so on switches that support ELS frame policing until initiators are patched.

bash

# Verify running kernel version and FC HBA drivers in use
uname -r
lsmod | grep -E 'lpfc|qla2xxx'

# Review recent kernel messages from the SCSI FC transport
dmesg -T | grep -Ei 'fc_fpin|scsi_transport_fc|lpfc|qla2xxx'

# Inspect FPIN statistics exposed by the FC transport
for h in /sys/class/fc_host/host*; do
  echo "== $h =="
  cat "$h/statistics/fpin_cn_signals" 2>/dev/null
done