Look up another CVE · open CVE-2026-63889 in the interactive tracker
CVE-2026-63889
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem drivers/scsi. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-63889 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.176-1 | Update the kernel and reboot. Fixed in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport. This is not a local userspace or IP network path; the attacker must be able to inject fabric traffic, for example as a compromised switch or fabric controller, or as a same-zone N_Port on a fabric that permits source spoofing. The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter against the 32-bit on-wire pname_count field, and did not bound pname_count by the descriptor body already validated by the TLV walker. A pname_count of 256 therefore wraps the counter and keeps the loop condition true indefinitely. Factor the shared pname_list[] walk into one helper, widen the counter to u32, and clamp pname_count against the entries that fit in the descriptor body before iterating.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/scsi/scsi_transport_fc.c
- What this is
- SCSI SUBSYSTEMMAINTAINERS section matched on drivers/scsi/ · linux-scsi@vger.kernel.org · Maintained
- Kernel module
- scsi_transport_fc
Check it on the machine
grep -w CONFIG_SCSI_FC_ATTRS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w scsi_transport_fcPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_SCSI_FC_ATTRS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 8.1 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.36%, higher than 28.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/scsi
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.11 | 5.15.210 | 07776b7779c9 |
| 5.11 | 6.1.176 | 29f126f09e34 |
| 5.11 | 6.6.143 | 163bd704d751 |
| 5.11 | 6.12.93 | ee57b89e5da9 |
| 5.11 | 6.18.35 | 35461d237441 |
| 5.11 | 7.0.12 | bdff76dff6ec |
| 5.11 | 7.1 | a9a39233ec1f |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- Exploitation requires injecting a crafted FPIN ELS frame onto the Fibre Channel fabric from an adjacent fabric actor (compromised switch, fabric controller, or same-zone N_Port), not via IP or local syscalls.
- AC:LAttack complexity, low
- Once on the fabric, an attacker can reliably trigger the bug by sending an FPIN with a Link-Integrity or Peer-Congestion descriptor containing pname_count=256 and a minimally valid TLV length; no race or special memory layout is required.
- PR:NPrivileges required, none
- The attacker needs no privileges on the victim Linux host; FPIN ELS frames are processed without authentication once the HBA has completed fabric discovery.
- UI:NUser interaction, none
- No victim user action is required; the malicious FPIN is processed automatically when received by the HBA firmware and driver stack.
- S:UScope, unchanged
- Impact is confined to kernel availability and information disclosure on the affected host; it does not cross a security boundary such as VM escape or sandbox breakout.
- C:HConfidentiality impact, high
- The unbounded loop reads pname_list[i] beyond the validated descriptor body via out-of-bounds kernel memory reads on every iteration, enabling information disclosure from adjacent kernel memory.
- I:NIntegrity impact, none
- The bug causes only counter increments in FPIN statistics structures on matched rports; there is no memory corruption or write primitive that could modify arbitrary data or achieve code execution.
- A:HAvailability impact, high
- The infinite loop pins a CPU in kernel context (potentially from interrupt/DPC paths) and repeatedly acquires host_lock via fc_find_rport_by_wwpn(), causing soft lockup and complete loss of host availability.