The Linux kernel's scsi: fcoe driver had a flaw in the fcoe_ctlr_recv_clr_vlink() function where it advanced a descriptor cursor by an attacker-supplied length (fip_dlen) without verifying that this length was at least the size of a descriptor header. While named descriptor types enforced minimum length checks, non-critical descriptors (fip_dtype >= 128), which should be silently ignored, bypassed this validation. An attacker could exploit this by sending a FIP CVL frame with a single non-critical descriptor of zero length, causing the processing loop to never advance and hang indefinitely. The fix enforces a minimum length check on all descriptors, preventing malformed descriptors from causing infinite loops.

An unauthenticated attacker on the same Layer 2 FCoE control VLAN can cause a denial of service by hanging the FCoE controller's receive processing loop indefinitely. This blocks all subsequent FIP frames on that controller, potentially disrupting storage network communications that rely on FCoE.

A fix has been implemented in the Linux kernel to reject FIP descriptors with lengths smaller than the descriptor header size, preventing infinite loops caused by malformed descriptors. Users should update to a kernel version that includes this fix once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.