Junos OS: integer underflow in Extended Echo handling crashes the kernel from the network

CVSS 9.3CVE-2026-101980Firmware, BMC & network fabriccurated

Impact

An unauthenticated attacker who can send packets to a Junos device with Extended Echo configured can trigger an integer underflow in the kernel and panic the box. On a device carrying GPU cluster traffic - a leaf, spine, or border router in front of the fabric - a kernel panic is a full forwarding outage for everything behind it, not a single degraded link, and it can be repeated as long as the feature stays configured. Juniper scores it 9.3 with high confidentiality and integrity sub-scores, but the described outcome is a denial of service. Control-plane reachability of the device is the whole precondition, which is why management and peering filters matter here.

Who can reach it

Network, no authentication. Anyone who can land packets on a Junos device that has Extended Echo configured - from a peered network, a tenant segment that is not filtered, or the management VLAN.

What to do

Apply the fixed Junos releases listed in Juniper advisory JSA112188; the record does not enumerate fixed versions, so read the advisory for the train you run. A Junos upgrade is a device reboot: schedule it per device, and expect a traffic drain on anything not in a redundant pair. Until then, disabling Extended Echo removes the exposure, and control-plane filters limit who can reach the kernel path.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101980 https://supportportal.juniper.net/JSA112188

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.