Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-63889— scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于scsi_transport_fc中FPIN pname walker计数器使用u8类型，导致pname_count为256时计数器回绕并导致无限循环，相邻光纤通道结构参与者可向lpfc或qla2xxx Linux启动器发送FPIN ELS帧触发通用FC传输中的非返回问题。

CVSS 8.1 · High EPSS 0.39% · P32

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 3dcfe0de5a9752e646a61f4ce513ac059960c7c3< 07776b7779c9426982c1ad74aad91bd531593790 affected
3dcfe0de5a9752e646a61f4ce513ac059960c7c3< 29f126f09e34a425b376b3646c89aa7cc18b142c affected
3dcfe0de5a9752e646a61f4ce513ac059960c7c3< 163bd704d7515c3df6c2e03bcba93d1db79edbff affected
3dcfe0de5a9752e646a61f4ce513ac059960c7c3< ee57b89e5da9fffbe0d26647e4ff0750dacb9943 affected
3dcfe0de5a9752e646a61f4ce513ac059960c7c3< 35461d23744175a78b6280293892cca357c22793 affected
3dcfe0de5a9752e646a61f4ce513ac059960c7c3< bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770 affected
3dcfe0de5a9752e646a61f4ce513ac059960c7c3< a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153 affected
5.11 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63889

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport. This is not a local userspace or IP network path; the attacker must be able to inject fabric traffic, for example as a compromised switch or fabric controller, or as a same-zone N_Port on a fabric that permits source spoofing. The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter against the 32-bit on-wire pname_count field, and did not bound pname_count by the descriptor body already validated by the TLV walker. A pname_count of 256 therefore wraps the counter and keeps the loop condition true indefinitely. Factor the shared pname_list[] walk into one helper, widen the counter to u32, and clamp pname_count against the entries that fit in the descriptor body before iterating.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于scsi_transport_fc中FPIN pname walker计数器使用u8类型，导致pname_count为256时计数器回绕并导致无限循环，相邻光纤通道结构参与者可向lpfc或qla2xxx Linux启动器发送FPIN ELS帧触发通用FC传输中的非返回问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 ~ 07776b7779c9426982c1ad74aad91bd531593790 -
Linux Linux 5.11 -

II. Public POCs for CVE-2026-63889

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63889

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63889 (6)

Same Patch Batch · Linux · 2026-07-19 · 429 CVEs total

CVE-2026-63795 10.0 CRITICAL 9p: avoid putting oldfid in p9_client_walk() error path
CVE-2026-63922 9.8 CRITICAL ipv6: exthdrs: refresh nh after handling HAO option
CVE-2026-53398 9.8 CRITICAL NFSD: Fix SECINFO_NO_NAME decode error cleanup
CVE-2026-63984 9.8 CRITICAL ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
CVE-2026-64025 9.8 CRITICAL bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
CVE-2026-63979 9.8 CRITICAL net/handshake: hand off the pinned file reference to accept_doit
CVE-2026-64033 9.8 CRITICAL RDMA/rtrs: Fix use-after-free in path file creation cleanup
CVE-2026-64056 9.8 CRITICAL net: ethernet: cortina: Make RX SKB per-port
CVE-2026-63800 9.8 CRITICAL pNFS: Fix use-after-free in pnfs_update_layout()
CVE-2026-63978 9.8 CRITICAL net/handshake: Drain pending requests at net namespace exit
CVE-2026-64055 9.8 CRITICAL net: ethernet: cortina: Carry over frag counter
CVE-2026-63808 9.8 CRITICAL exfat: fix potential use-after-free in exfat_find_dir_entry()
CVE-2026-63888 9.8 CRITICAL scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
CVE-2026-63887 9.8 CRITICAL scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
CVE-2026-63886 9.8 CRITICAL scsi: target: iscsi: Validate CHAP_R length before base64 decode
CVE-2026-64113 9.8 CRITICAL ixgbevf: fix use-after-free in VEPA multicast source pruning
CVE-2026-64035 9.8 CRITICAL igc: set tx buffer type for SMD frames
CVE-2026-64162 9.8 CRITICAL idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
CVE-2026-64150 9.8 CRITICAL netfilter: nft_inner: release local_lock before re-enabling softirqs
CVE-2026-64046 9.8 CRITICAL net: tls: prevent chain-after-chain in plain text SG

Showing top 20 of 429 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-63889

No comments yet

Leave a comment