In the Linux kernel's Fibre Channel over Ethernet (FCoE) controller, a flaw in the CVL walker allows an attacker to send a FIP descriptor with type not verified that the length field is at least the size of the descriptor header, which causes the loop to continue indefinitely and blocks the fcoe_ctlr_recv_work routine, effectively preventing the controller from processing any subsequent FIP frames and causing a denial of service of the entire FCoE subsystem.

All Linux kernel releases that include the fcoe_ctlr module and support FCoE before the patch that tightens the descriptor length check are vulnerable. The fix is patch; systems that have not yet applied or cannot apply the updated kernel are affected.

The CVE is not listed in CISA’s KEV catalog and its EPSS score of < 1% indicates a very low likelihood of exploitation in the wild, suggesting a low overall exploitation probability in the broader landscape. Nonetheless, the attack vector requires only an unauthenticated host that can reach the FCoE control VLAN, making it potentially executable from any device capable of sending Layer‑2 frames to that VLAN; the DoS impacts all initiators that rely on the affected controller, and the loop condition flaw means the controller cannot recover without intervention. The CVSS score for this vulnerability is 5.5.