Arista EOS: crafted BGP-LS message from an established peer restarts the BGP agent

CVSS 6.0CVE-2026-120978Firmware, BMC & network fabriccurated

Impact

A peer that already has an authenticated BGP-LS session with the switch can send a crafted message that makes the BGP agent restart unexpectedly. While BGP restarts, routes learned over BGP are lost, so on a fabric that uses BGP for its underlay or overlay this can briefly cut traffic through the switch, including GPU-to-GPU and storage traffic. Only switches running BGP-LS with the Dynamic Path Selection consumer role configured are affected. A Pathfinder deployment is not required. The record does not describe any confidentiality or integrity impact.

Who can reach it

An authenticated BGP-LS peer of the affected switch. The attacker must control or compromise a configured BGP-LS neighbor. Unauthenticated hosts cannot trigger it.

What to do

Check Arista Security Advisory 0211 for the affected and fixed EOS releases and any workaround. Upgrading EOS on a switch usually means a planned maintenance window per switch, or a hitless upgrade where the platform supports it. Until patched, limit BGP-LS sessions to trusted peers and turn off the DPS consumer role where it is not used.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-120978 https://www.arista.com/en/support/advisories-notices/security-advisory/25033-security-advisory-0211

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.