CVE-2026-63890

In the Linux kernel, the following vulnerability has been resolved:

scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker

drivers/scsi/fcoe/fcoectlr.c::fcoectlrrecvclrvlink() advanced the descriptor cursor by an attacker-supplied fipdlen without ever requiring dlen >= sizeof(struct fipdesc) in the default branch. The named descriptor cases (FIPDTMAC, FIPDTNAME, FIPDTVNID) checked their per-type minimum lengths, but a FIPDTNONCRITICAL descriptor (fipdtype >= 128, which the standard requires receivers to silently ignore) skipped that check entirely.

An unauthenticated L2 peer on the FCoE control VLAN could hang fcoectlrrecvwork on an fcoe, qedf, or bnx2fc initiator indefinitely by emitting one FIP CVL frame whose single descriptor had fipdtype == FIPDTNONCRITICAL and fipdlen == 0: the cursor advanced zero bytes per iteration and the loop condition rlen >= sizeof(*desc) stayed true forever, blocking every subsequent FIP frame on that controller.

Tighten the outer dlen guard to also reject dlen < sizeof(struct fip_desc), so a malformed descriptor whose length cannot even cover the descriptor header is rejected before the switch. This is the same lower-bound the named cases already apply and is the minimum scope that closes the loop.