In the Linux kernel’s SCSI over Fibre Channel transport, FPIN (Fabric Policy Information Node) walkers used an 8‑bit loop counter against a 32‑bit on‑wire pname_count field and did not limit pname_count to the number of entries validated by the TLV walker. When a malicious actor sends an FPIN ELS frame with a pname_count of 256, the counter overflows, causing the loop condition to remain true indefinitely. This results in a non‑returning state that effectively freezes the Fibre Channel transport stack, leading to resource exhaustion and a denial‑of‑service for the affected host.

The vulnerability affects Linux kernel implementations that support SCSI to Fibre Channel via the lpfc or qla2xxx drivers. All Linux kernel releases that include these drivers prior to the patch are impacted, including the release candidates 7.1rc1 through 7.1rc5 and earlier kernel versions that contain the same code paths. System administrators should refer to their distribution’s kernel changelogs for the specific release that incorporates the fix.

The CVSS score of 8.1 demonstrates a high severity potential, whereas the EPSS score of < 1% indicates that exploitation is currently considered unlikely. The vulnerability is not listed in CISA’s KEV catalog, so no public exploitation is documented. However, an attacker must be able to inject malformed FC traffic, which typically requires control over a fabric switch, fabric controller, or a malicious N_Port with source spoofing abilities. Under those conditions, the denial‑of‑service could affect multiple hosts within the same fabric zone.