Debian Patches

Status for frr/10.3-3+deb13u1

Patch Description Author Forwarded Bugs Origin Last update
upstream/0001-fix-ftbfs-s390x.patch tests: use little-endian order for libyang api Use the expected - little-endian - byte-order for a param
to one of the libyang apis; tests fail on LE architectures
otherwise.

diff -Naurp frr.orig/tests/lib/northbound/test_oper_data.c frr/tests/lib/northbound/test_oper_data.c		 Mark Stapp <mjs@cisco.com> no
CVE-2025-61104.patch add NULL check for vty_out in check_tlv_size Companion to CVE-2025-61099.patch: guard the vty_out() call in check_tlv_size()
in ospf_ext.c so the OSPF Opaque LSA detail dump path does not dereference a
NULL vty (CVE-2025-61104).
diff --git a/ospfd/ospf_ext.c b/ospfd/ospf_ext.c
index c80ad636a1..cef27498b8 100644		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/b7d9b7aa47627b31e4b50795284408ab6de98660
CVE-2026-37457.patch fix off-by-one out-of-bounds write in FlowSpec operator array An off-by-one error in the FlowSpec operator decoding (bgp_flowspec_op_decode /
bgp_flowspec_bitmask_decode) allows a crafted FlowSpec NLRI with more than the
maximum number of chained operators to write one element past the mval[] array,
leading to a stack out-of-bounds write (CVE-2026-37457).
.
Adapted from upstream commit 0e6882bc72 / stable backport bc106c9fa9 to the
10.3 release tree: op_decode lacked the early return, and bitmask_decode already
had the braces+return but used the wrong (>) comparison.		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/0e6882bc72c0278988a47b2f0f73b7a91099a25c
CVE-2026-28532.patch harden OSPF TE/SR TLV iteration against malformed lengths A uint16_t accumulator truncated uint32_t TLV_SIZE() values in the OSPF TE/SR
TLV parsers (ospf_te.c, ospf_sr.c), so a crafted Opaque LSA with malformed TLV
lengths could make the loop terminator fail while the read pointer advanced,
causing an out-of-bounds read / ospfd crash (CVE-2026-28532).
diff --git a/ospfd/ospf_sr.c b/ospfd/ospf_sr.c
index 89db97922f..fefb177937 100644		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/31dd5cb832
CVE-2026-5107.patch improve packet parsing for EVPN and ENCAP/VNC Missing validation of the EVPN NLRI ipaddr_len against psize in the EVPN
Type-2/3/4 route handlers (and a VNC/ENCAP sub-TLV length check) allowed
crafted BGP UPDATE messages to manipulate routes or trigger a limited DoS
(CVE-2026-5107).
diff --git a/bgpd/bgp_evpn.c b/bgpd/bgp_evpn.c
index b768700b3d..609b180301 100644		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/59d4c4a0b8
CVE-2026-37458.patch validate MP_REACH_NLRI attribute against incorrect next-hop The IPv4 next-hop carried in an MP_REACH_NLRI attribute was not validated, so
a martian next-hop was accepted and could cause a denial of service. Reject the
attribute (treat-as-withdraw) when the next-hop is a martian address, unless
the operator explicitly allowed martian next-hops (CVE-2026-37458).
.
Backported from the upstream master commit; there is no upstream stable/10.3
backport. allow_martian exists in 10.3, so the upstream change applies directly.
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
index bfc6e520ca..8430a746d7 100644		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/8102a8aeceb9f86fdfe1f80cd77080522bab69c8
CVE-2025-61099_61107.patch fix NULL pointer dereference when dumping OSPF link info When "debug ospf packet ... detail" is enabled, ospfd dumps Opaque LSAs by
calling the per-type show callbacks with a NULL vty (intending zlog output).
The TE/SR Extended-Link/Prefix dump helpers in ospf_ext.c dereferenced vty
(via vty_out) without a NULL check, so a crafted OSPF LS-Update could crash
ospfd (remote, unauthenticated DoS). This covers CVE-2025-61099, CVE-2025-61100,
CVE-2025-61101, CVE-2025-61102, CVE-2025-61103, CVE-2025-61105, CVE-2025-61106
and CVE-2025-61107; CVE-2025-61104 is completed by the companion patch
CVE-2025-61104.patch.
diff --git a/ospfd/ospf_ext.c b/ospfd/ospf_ext.c
index cef27498b8..cb709f41ee 100644		 not-needed upstream backport, https://github.com/FRRouting/frr/commit/034e6fe67078810b952630055614ee5710d1196e

All known versions for source package 'frr'

Links