CyberSecBulletin
CVE-2026-63889NVD status: Analyzed

Linux: Loop with Unreachable Exit Condition

Published Updated By the CyberSecBulletin desk

CVE-2026-63889 is a high-severity loop with unreachable exit condition vulnerability in Linux, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 07776b7779c9426982c1ad74aad91bd531593790, 29f126f09e34a425b376b3646c89aa7cc18b142c, 163bd704d7515c3df6c2e03bcba93d1db79edbff as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.36% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 07776b7779c9426982c1ad74aad91bd531593790 or 29f126f09e34a425b376b3646c89aa7cc18b142c or 163bd704d7515c3df6c2e03bcba93d1db79edbff or ee57b89e5da9fffbe0d26647e4ff0750dacb9943, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.210 or 6.1.176 or 6.6.143 or 6.12.93, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux3dcfe0de5a9752e646a61f4ce513ac059960c7c3 up to, but not including, 07776b7779c9426982c1ad74aad91bd531593790; 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 up to, but not including, 29f126f09e34a425b376b3646c89aa7cc18b142c; 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 up to, but not including, 163bd704d7515c3df6c2e03bcba93d1db79edbff; 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 up to, but not including, ee57b89e5da9fffbe0d26647e4ff0750dacb9943; 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 up to, but not including, 35461d23744175a78b6280293892cca357c22793; 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 up to, but not including, bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770; 3dcfe0de5a9752e646a61f4ce513ac059960c7c3 up to, but not including, a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153; 5.1107776b7779c9426982c1ad74aad91bd531593790, 29f126f09e34a425b376b3646c89aa7cc18b142c, 163bd704d7515c3df6c2e03bcba93d1db79edbff, ee57b89e5da9fffbe0d26647e4ff0750dacb9943, 35461d23744175a78b6280293892cca357c22793, bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770
LinuxLinux Kernel5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.93; 6.13 up to, but not including, 6.18.35; 6.19 up to, but not including, 7.0.12; 7.15.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport. This is not a local userspace or IP network path; the attacker must be able to inject fabric traffic, for example as a compromised switch or fabric controller, or as a same-zone N_Port on a fabric that permits source spoofing. The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter against the 32-bit on-wire pname_count field, and did not bound pname_count by the descriptor body already validated by the TLV walker. A pname_count of 256 therefore wraps the counter and keeps the loop condition true indefinitely. Factor the shared pname_list[] walk into one helper, widen the counter to u32, and clamp pname_count against the entries that fit in the descriptor body before iterating.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Loop with Unreachable Exit Condition

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

More Loop with Unreachable Exit Condition vulnerabilities (CWE-835)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Loop with Unreachable Exit Condition vulnerabilities

Spotted an error? Tell us.