AZL-99585 CVE-2026-80790 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: fix invalid free in LS IOD error path nvmetfcalloclsiodlist advances iod while initializing the LS IOD array. If an rqstbuf allocation or response buffer DMA mapping fails, the unwind loop decrements iod past the start ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet: The cqe.result field must always be initialized. The specification does not require that the first two double-word values i.e., the “results” for a command queue entry need to be set to 0 when they are not used this is not...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoiding deadlock on the delete association path When deleting an association, the shutdown path experiences a deadlock condition because we try to flush the nvmetwq nested structure. This issue can be avoided by delayi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to connect Fibre Channel LUNs to the host system and present them as SCSI devices in a guest VM. I/O to the vFC device is handled by the...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: The BUGON flag has been removed when the event pool is empty. In practice, the driver should never send more commands than are allocated to the event pool. If this happens, the code will assert the BUGON flag. In th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fixed a resource leak in lpfcsli4sendseqtoulp. If no handler is found in lpfccompleteunsoliocb that matches the recipient of a received frame, the frame is discarded, and resources may be leaked. This issue was...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fixed the buffer release/clearing order in the deferred receive path. A use-after-free condition was addressed by correcting the buffer release sequence in the deferred receive path. The code first released the RQ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: qedf: Add stagwork to all the vports A call trace was observed when creating NPIV ports. Only 32 out of 64 ports are shown as online. The stagwork was not initialized for the vports; therefore, it needs to be initialized...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: Reverted “scsi: fcoe: Fix potential deadlock on &fip-ctlrlock”. This reversion involves commit 1a1975551943f681772720f639ff42fbaa746212. This commit causes interrupts to be lost for FCoE devices, as it changed the sping loc...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: ibmvfc: Queue resources are allocated/free only during probe/remove operations. Currently, sub-queues and event pool resources are allocated/free for every CRQ connection event, such as resets and LPM. This exposes the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nvme: nvme-fc: Ensure -ioerrwork is cancelled in nvmefcdeletectrl nvmefcdeleteassociation waits for pending I/O to complete before returning. An error can cause -ioerrwork to be queued after cancelworksync has been called. Mov...

CVE-2026-63890

A flaw was found in the Linux kernel's Fibre Channel over Ethernet FCoE module. An unauthenticated attacker on the same Layer 2 L2 network segment could send a specially crafted FCoE Initialization Protocol FIP frame with a malformed descriptor. This could lead to an infinite loop, causing a deni...

CVE-2026-63889

A flaw was found in the Linux kernel's Fibre Channel FC transport component. An adjacent Fibre Channel fabric actor, such as a compromised switch or fabric controller, can send a specially crafted FPIN ELS Fabric Performance Incentive Notification Extended Link Service frame. This malformed frame...

SUSE CVE-2026-63889

In the Linux kernel, the following vulnerability has been resolved: scsi: scsitransportfc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport...

SUSE CVE-2026-63890

In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Reject FIP descriptors with zero fipdlen in CVL walker drivers/scsi/fcoe/fcoectlr.c::fcoectlrrecvclrvlink advanced the descriptor cursor by an attacker-supplied fipdlen without ever requiring dlen = sizeofstruct fipde...

Linux Distros Unpatched Vulnerability : CVE-2026-63890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: fcoe: Reject FIP descriptors with zero fipdlen in CVL walker drivers/scsi/fcoe/fcoectlr.c::fcoectlrrecvclrvlink advanced the descriptor cursor by an...

Linux Distros Unpatched Vulnerability : CVE-2026-63889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: scsitransportfc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx...

CVE-2026-63889

In the Linux kernel, the following vulnerability has been resolved: scsi: scsitransportfc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport...

CVE-2026-63890

The CVE-2026-63890 entry describes a Linux kernel vulnerability in the SCSI FCoE CVL walker where an unauthenticated L2 peer can hang fcoe_ctlr_recv_work on fcoe, qedf, or bnx2fc initiators by sending a CVL frame with a non‑critical descriptor (fip_dtype >= 128) and fip_dlen == 0. The issue ar...

CVE-2026-63890 scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker

In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Reject FIP descriptors with zero fipdlen in CVL walker drivers/scsi/fcoe/fcoectlr.c::fcoectlrrecvclrvlink advanced the descriptor cursor by an attacker-supplied fipdlen without ever requiring dlen = sizeofstruct fipde...