In the Linux kernel’s Fibre Channel transport layer, the Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter against the 32‑bit on‑wire pname_count field and did not bound pname_count by the descriptor body already validated by the TLV walker. A pname_count of 256 therefore wraps the counter and keeps the loop condition true indefinitely, allowing an attacker who can inject malicious FC ELS frames to trigger a non‑returning state in the transport stack. Consequently, the affected system can experience resource exhaustion or a denial‑of‑service that may require a reboot to recover loop, a classic denial‑of‑service flaw.

The affected Fiber Channel transport code before the applied fix. This includes kernel variants that use the lpfc or qla2xxx drivers for SCSI over Fibre Channel. No specific kernel version is enumerated in the data; system administrators should consult Linux kernel release notes for the fix in the appropriate distribution updates.

The CVSS score of 8.1 indicates high severity, while the EPSS score of < 1% shows that exploitation is considered unlikely at present. The vulnerability is not yet listed as a Known Exploited Vulnerability by CISA. Attackers must have the ability to inject fabric traffic, which typically requires control over a fabric switch, fabric controller, or a malicious N_Port with source spoofing capabilities. In those cases, a denial of service can impair critical storage or network services across multiple hosts within the same fabric zone.