CVE-2026-63889

A flaw was found in the Linux kernel's Fibre Channel (FC) transport component. An adjacent Fibre Channel fabric actor, such as a compromised switch or fabric controller, can send a specially crafted FPIN ELS (Fabric Performance Incentive Notification Extended Link Service) frame. This malformed frame, specifically with a pname_count field that causes an integer overflow, can trigger an infinite loop, leading to a Denial of Service (DoS) in the affected system.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires direct access to an adjacent Fibre Channel storage fabric rather than a general IP or local network interface. Systems are only vulnerable if configured with Fibre Channel host bus adapters connecting to an untrusted or compromised storage area network. While successfully triggering the infinite loop results in an unresponsive kernel and host-level denial of service, the prerequisite of fabric-level access or malicious switch control limits the overall blast radius across typical server deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.