dbcve.org
VulnerabilityAwaiting classification

CVE-2026-63889

HIGH · 8.1 CVSS v3.1 Published 2026-07-19
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
86/100
Remediation priority · High
No privileges Zero-click 5 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport. This is not a local userspace or IP network path; the attacker must be able to inject fabric traffic, for example as a compromised switch or fabric controller, or as a same-zone N_Port on a fabric that permits source spoofing. The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter against the 32-bit on-wire pname_count field, and did not bound pname_count by the descriptor body already validated by the TLV walker. A pname_count of 256 therefore wraps the counter and keeps the loop condition true indefinitely. Factor the shared pname_list[] walk into one helper, widen the counter to u32, and clamp pname_count against the entries that fit in the descriptor body before iterating.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Linux kernel's SCSI FC transport contains an integer wrap vulnerability in FPIN (Fabric Performance Impact Notification) frame handling. When processing Link-Integrity or Peer-Congestion FPIN frames, an 8-bit (u8) loop counter is used against a 32-bit pname_count field from the wire. A pname_count value of 256 or greater causes the counter to wrap to 0, keeping the loop condition true indefinitely and creating an infinite loop (non-return). The attacker requires adjacent fabric access (compromised switch, fabric controller, or spoofed N_Port) to inject malicious FPIN frames.

MitigationApply the upstream kernel patch which widens the loop counter to u32 and adds bounds clamping before iteration. As a compensating control, restrict physical access to the Fibre Channel fabric and ensure switches/controllers are not compromised.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check kernel version for FPIN ELS fix inclusion
    Run 'uname -r' to get the running kernel version, then check if the fix (counter widened to u32 with bounds checking) is present in the kernel source code for scsi_transport_fc
    Affected if Running a kernel version prior to the fix that contains the vulnerable FPIN ELS pname_count handling code with a u8 loop counter
  2. Verify scsi_transport_fc module status
    Run 'lsmod | grep scsi_transport_fc' or check '/sys/module/scsi_transport_fc' to see if the Fibre Channel transport module is loaded
    Affected if The scsi_transport_fc module is loaded or compiled into the kernel and the system uses Fibre Channel storage
  3. Check for active FC HBAs
    Run 'ls /sys/class/fc_host' or 'cat /sys/class/fc_host/host*/port_state' to enumerate Fibre Channel host bus adapters
    Affected if The system has active FC HBAs that can receive FPIN ELS frames from the fabric
  4. Identify FPIN ELS handling code presence
    Search kernel source or module for the fc_els_ct_unsol_acc function and the pname_count loop handling logic using 'grep -r fc_els_ct_unsol_acc /lib/modules/$(uname -r)' or equivalent
    Affected if The kernel contains the vulnerable code path that processes FPIN ELS frames with the unchecked u8 counter

A system is affected if it runs a vulnerable kernel version with scsi_transport_fc loaded and has active Fibre Channel HBAs that can receive the malicious FPIN ELS frames from an adjacent fabric actor.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply the upstream kernel patch which widens the loop counter to u32 and adds bounds clamping before iteration. As a compensating control, restrict physical access to the Fibre Channel fabric and ensure switches/controllers are not compromised.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation3.0 h
  • Testing4.0 h
  • Review / QA2.0 h
11.0 hours of engineering $1,900
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,040.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-63889 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-63889 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data