Linux Kernel CVE-2026-63889

The affected code is the SCSI FC transport layer (drivers/scsi/scsi_transport_fc.c), shared by the lpfc and qla2xxx initiator drivers. FPIN (Fabric Performance Impact Notification) is an FC-LS ELS mechanism by which a switch/fabric reports Link-Integrity and Peer-Congestion events; each notification carries a TLV descriptor containing a pname_list[] array whose length is given by the on-wire pname_count field (32-bit). The root cause is an integer-width mismatch and a missing bounds check: the descriptor-body walkers used a u8 loop counter to iterate a 32-bit pname_count, and did not clamp pname_count to the number of port-name entries that actually fit in the validated descriptor body. A pname_count of 256 overflows/wraps the u8 counter so the termination condition is never met - an unbounded loop consuming a CPU in kernel context. This is a classic loop-with-unreachable-exit-condition / improper input validation issue (no CWE was assigned in the source data). The fix factors the shared walk into one helper, widens the counter to u32, and clamps pname_count against the descriptor body before iterating.