CVE-2026-63890: Linux Kernel FCoE DOS Vulnerability

CVE-2026-63890 Overview

CVE-2026-63890 is a denial-of-service vulnerability in the Linux kernel's Fibre Channel over Ethernet (FCoE) subsystem. The flaw resides in drivers/scsi/fcoe/fcoe_ctlr.c, specifically the fcoe_ctlr_recv_clr_vlink() function that processes FIP (FCoE Initialization Protocol) Clear Virtual Link (CVL) frames. An unauthenticated Layer 2 peer on the FCoE control VLAN can send a single malformed FIP CVL frame that causes the kernel worker fcoe_ctlr_recv_work to loop indefinitely. The condition blocks all subsequent FIP frames on the affected controller, disrupting Fibre Channel storage connectivity on fcoe, qedf, and bnx2fc initiators.

Critical Impact
An unauthenticated adjacent attacker can indefinitely hang the FCoE control receive worker with a single crafted frame, disabling storage connectivity on affected initiators.

Affected Products

Linux kernel FCoE driver (drivers/scsi/fcoe/fcoe_ctlr.c)
QLogic FastLinQ FCoE driver (qedf)
Broadcom NetXtreme II FCoE driver (bnx2fc)

Discovery Timeline

2026-07-19 - CVE-2026-63890 published to the National Vulnerability Database
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63890

Vulnerability Analysis

The vulnerability is an infinite loop denial of service triggered during FIP descriptor parsing. The fcoe_ctlr_recv_clr_vlink() function walks a list of FIP descriptors received in a Clear Virtual Link frame. For each descriptor, the parser advances a cursor by the attacker-controlled fip_dlen value scaled to bytes. The outer loop continues while rlen >= sizeof(*desc).

Named descriptor types such as FIP_DT_MAC, FIP_DT_NAME, and FIP_DT_VN_ID each validate per-type minimum lengths before use. However, the default branch that handles descriptors with fip_dtype >= 128 (marked FIP_DT_NON_CRITICAL by the FIP specification) skipped any length validation. The standard requires receivers to silently ignore non-critical descriptors, and the driver honored that intent without enforcing a lower bound on fip_dlen.

Because the cursor advanced by zero bytes when fip_dlen == 0, and rlen never decremented, the walker never terminated. The kernel worker thread fcoe_ctlr_recv_work remained pinned, blocking every subsequent FIP frame arriving on that controller.

Root Cause

The root cause is missing input validation [CWE-20] on the fip_dlen field before the descriptor type switch. The outer loop trusted the attacker-supplied length without requiring dlen >= sizeof(struct fip_desc), which is the minimum bytes required to even cover the descriptor header. Non-critical descriptors bypassed the per-case length checks that would otherwise catch this condition.

Attack Vector

Exploitation requires the attacker to send frames on the FCoE control VLAN reachable by a vulnerable initiator. No authentication is required. The attacker transmits a single FIP CVL frame containing exactly one descriptor with fip_dtype set to a value at or above 128 and fip_dlen set to 0. Upon receipt, the initiator's FIP receive worker enters an unbounded loop and stops servicing further FIP traffic, terminating the FCoE session lifecycle and disrupting SCSI over FCoE storage paths.

No verified public exploit code is available. Refer to the upstream commits listed under Patch Information for the exact source-level fix.

Detection Methods for CVE-2026-63890

Indicators of Compromise

FCoE initiators (fcoe, qedf, bnx2fc) that stop processing FIP frames or lose virtual link state without corresponding link-layer events.
Kernel worker fcoe_ctlr_recv_work observed as running or stuck for extended periods in ps or /proc/<pid>/stack output.
Unexpected FIP CVL frames on the FCoE control VLAN originating from unknown MAC addresses.

Detection Strategies

Monitor kernel soft lockup and hung task warnings referencing fcoe_ctlr_recv_work or the FCoE worker queue in dmesg and syslog.
Inspect FIP traffic on FCoE control VLANs for descriptors with fip_dtype >= 128 and fip_dlen == 0, which are anomalous under normal operation.
Correlate loss of Fibre Channel session activity with the arrival of unauthenticated FIP frames from non-FCF (FCoE Forwarder) sources.

Monitoring Recommendations

Ingest kernel and storage subsystem logs into a centralized platform to alert on FCoE session flaps and worker hangs.
Track SCSI I/O error rates and path failover events on hosts using qedf or bnx2fc HBAs as leading indicators of FIP disruption.
Enable VLAN-level flow logs where supported to identify unexpected L2 sources on the FCoE control VLAN.

How to Mitigate CVE-2026-63890

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by your distribution vendor as soon as fixed builds are available.
Restrict the FCoE control VLAN to trusted converged network adapter ports and FCoE Forwarders only.
Audit hosts with fcoe, qedf, or bnx2fc modules loaded and prioritize patching where FCoE is actively in use.

Patch Information

The fix tightens the outer dlen guard in fcoe_ctlr_recv_clr_vlink() to also reject dlen < sizeof(struct fip_desc), matching the lower bound already applied by the named descriptor cases. Patches are available in the following upstream commits: 0e3c6e5a8fc1, 14dd80a20a72, 549859a11310, 80a0cd307205, 9eed1bd59937, d179949d2175, d537d29d51c8, and fda976f7390b.

Workarounds

Unload the FCoE modules (fcoe, libfcoe, qedf, bnx2fc) on systems that do not require FCoE storage connectivity.
Blacklist the FCoE drivers via /etc/modprobe.d/ configuration files to prevent load at boot on hosts without FCoE workloads.
Enforce switch-side ACLs to limit which MAC addresses can transmit FIP frames on the FCoE control VLAN, blocking unauthenticated L2 peers.

bash

# Configuration example: blacklist FCoE drivers where FCoE is not required
echo "blacklist fcoe"    | sudo tee /etc/modprobe.d/blacklist-fcoe.conf
echo "blacklist libfcoe" | sudo tee -a /etc/modprobe.d/blacklist-fcoe.conf
echo "blacklist qedf"    | sudo tee -a /etc/modprobe.d/blacklist-fcoe.conf
echo "blacklist bnx2fc"  | sudo tee -a /etc/modprobe.d/blacklist-fcoe.conf
sudo update-initramfs -u