Memory Management Flaw in FRRouting Affects BGP Functionality

CVE-2026-120221

What is CVE-2026-120221?

In FRRouting versions 8.4 and later, a critical memory management issue arises when dynamic BGP neighbors disconnect. This flaw is rooted in the handling of peer-group configurations using a Site-of-Origin (SoO). Specifically, multiple dynamic neighbors that share the same SoO incorrectly refer to the same memory allocation. When a neighbor is deleted, the memory is prematurely freed, and a subsequent disconnect attempts to free it again, resulting in potential router crashes. This vulnerability can be exploited by hosts within the listen range, allowing them to open and close TCP connections to the BGP port leading to failures in the BGP daemon (bgpd). It is especially concerning as configurations combining listen ranges with SoO settings are uniquely susceptible, posing significant risks to network stability.

References