IPv4 Packet Processing Vulnerability in Cisco ASR 9000 and 9900 Series Routers

CVE-2026-76505

What is CVE-2026-76505?

A vulnerability exists in the IPv4 packet processing functionality of Cisco IOS XR Software impacting Cisco ASR 9000 and 9900 Series Routers. This issue can permit unauthenticated, remote exploitation leading to network processor (NP) errors. An attacker exploiting this vulnerability can cause a line card to reset or shut down, resulting in denial of service (DoS) conditions. This is triggered by the incorrect handling of specially crafted IPv4 packets processed as for-us traffic on affected line card interfaces. Continuous exploitation can lead to persistent NP shutdowns, necessitating an explicit line card reload to restore functionality. Notably, this vulnerability does not impact transit IPv4 traffic or IPv6 traffic.

References