Linux kernel FC transport: malformed FPIN ELS frame hangs the kernel via a u8 pname walker counter

Impact

The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter against the 32-bit on-wire pname_count field and never bounded it by the validated descriptor body, so a pname_count of 256 wraps the counter and the loop never returns - a hard hang in the generic FC transport. Reaching it requires injecting fabric traffic, for example from a compromised FC switch or fabric controller, or a same-zone N_Port on a fabric that permits source spoofing. GPU clusters that back checkpoints and datasets with Fibre Channel storage run lpfc or qla2xxx on the nodes and on the storage heads; a wedged node there is a node-drain the operator did not schedule, and the attack crosses from the fabric into hosts that otherwise share nothing. The fix factors the walk into one helper, widens the counter to u32, and clamps pname_count against the descriptor body.

Who can reach it

An adjacent Fibre Channel fabric actor able to deliver an FPIN ELS frame to an lpfc or qla2xxx initiator - a compromised switch or fabric controller, or a same-zone N_Port where the fabric allows source spoofing. Not reachable from local userspace or from the IP network; no host authentication involved.

What to do

Update to a stable kernel carrying the fix (commits in the references) on every host with an lpfc or qla2xxx HBA, and reboot - the fix is in the scsi_transport_fc module, and unloading it means tearing down FC storage paths, so plan a drain and reboot per node. Meanwhile, enforce hard zoning and port-level source checks on the FC fabric so only trusted N_Ports can deliver ELS frames.

References

Related entries

• Dell OpenManage Enterprise: low-privileged remote user can inject SQL into the management consoleCVE-2026-70422 · Dell OpenManage Enterprise (management console, SQL injection)High
• Dell OMSA: improper privilege management lets a low-privileged remote user tamper with the nodeCVE-2026-81442 · Dell OpenManage Server Administrator (privilege management)High
• Dell OMSA: missing authentication on a critical function lets an unauthenticated attacker execute codeCVE-2026-81475 · Dell OpenManage Server Administrator (managed node web/agent service)High
• Dell OMSA: unauthenticated OS command injection gives remote execution on the managed nodeCVE-2026-81476 · Dell OpenManage Server Administrator (managed node service, OS command handling)High
• Dell OMSA: hard-coded cryptographic key allows unauthenticated access to the management agentCVE-2026-81478 · Dell OpenManage Server Administrator (hard-coded cryptographic key)High
• InfiniBand / RoCE memory protection - memory region rkey/lkey namespace and protection domains: The only thing standingNCVD-2021-004-infiniband-roce-memory-protectio · InfiniBand / RoCE memory protection - memory region rkey/lkey namespace and protection domainsHigh