VulnerabilityPublished 19 Jul 2026

CVE-2026-63889: Linux kernel · scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

Source GCVE Database

Authoritative record:CVE-2026-63889· High 8.1

Not known to be exploited · CVSS 8.1 High · fixed in ee57b89e5da9fffbe0d26647e4ff0750dacb9943 : patch Linux kernel soon.

Data as of 26 Oct 2026, 17:16 UTC

CVSS 3.1 base score

8.1High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.3% chance of exploitation in 30 days – higher than 29% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ee57b89e5da9fffbe0d26647e4ff0750dacb9943, bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770, a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153 +4

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector: Adjacent
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Adjacent: The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-w68f-2wrj-q4g6

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 3dcfe0de5a9752e646a61f4ce513ac059960c7c3, < ee57b89e5da9fffbe0d26647e4ff0750dacb9943	Fixed in ee57b89e5da9fffbe0d26647e4ff0750dacb9943
LinuxLinux	Affected ≥ 3dcfe0de5a9752e646a61f4ce513ac059960c7c3, < bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770	Fixed in bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770
LinuxLinux	Affected ≥ 3dcfe0de5a9752e646a61f4ce513ac059960c7c3, < a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153	Fixed in a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153
LinuxLinux	Affected ≥ 3dcfe0de5a9752e646a61f4ce513ac059960c7c3, < 35461d23744175a78b6280293892cca357c22793	Fixed in 35461d23744175a78b6280293892cca357c22793
LinuxLinux	Affected ≥ 3dcfe0de5a9752e646a61f4ce513ac059960c7c3, < 07776b7779c9426982c1ad74aad91bd531593790	Fixed in 07776b7779c9426982c1ad74aad91bd531593790
LinuxLinux	Affected ≥ 3dcfe0de5a9752e646a61f4ce513ac059960c7c3, < 163bd704d7515c3df6c2e03bcba93d1db79edbff	Fixed in 163bd704d7515c3df6c2e03bcba93d1db79edbff

AI-suggested

A fix has been implemented in the Linux kernel to address this vulnerability by widening the FPIN pname walker counter and adding proper bounds checking. Users should update to the fixed Linux kernel version once available. Since this is not a cloud service, remediation depends on applying the official kernel patch.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport. This is not a local userspace or IP network path; the attacker must be able to inject fabric traffic, for example as a compromised switch or fabric controller, or as a same-zone N_Port on a fabric that permits source spoofing. The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter against the 32-bit on-wire pname_count field, and did not bound pname_count by the descriptor body already validated by the TLV walker. A pname_count of 256 therefore wraps the counter and keeps the loop condition true indefinitely. Factor the shared pname_list[] walk into one helper, widen the counter to u32, and clamp pname_count against the entries that fit in the descriptor body before iterating.

Impact

An attacker capable of injecting Fibre Channel fabric traffic could cause a denial of service by triggering an infinite loop in the Linux kernel's FC transport layer, potentially impacting system stability. This is not exploitable via local userspace or IP network paths and requires privileged network conditions such as compromised fabric components or source spoofing within the same fabric zone.

Summary

The Linux kernel contained a vulnerability in the scsi_transport_fc component where the FPIN pname walker used a u8 loop counter against a 32-bit pname_count field without proper bounds checking. This allowed an attacker controlling adjacent Fibre Channel fabric traffic to trigger an infinite loop (non-return) in the generic FC transport by delivering an FPIN ELS frame with a crafted pname_count of 256, causing the counter to wrap and the loop condition to remain true indefinitely. The fix involved consolidating the pname_list walk into a single helper, widening the loop counter to u32, and clamping pname_count to the validated descriptor body size before iteration.

References

Community reviews

Loading reviews…