Arista EOS S-BFD: crafted PDU crashes the kernel and reboots the initiator switch

CVSS 9.2CVE-2026-121295Firmware, BMC & network fabriccurated

Impact

An unauthenticated attacker can send a crafted Seamless BFD PDU to an EOS switch acting as an S-BFD initiator. This crashes the switch kernel and reboots the device. On a GPU fabric, an unplanned reboot of a leaf or spine takes down every link through it, which can break running training jobs across many nodes. The record describes availability impact only.

Who can reach it

Unauthenticated, over the network, against switches configured as S-BFD peers (initiator side). The record does not say whether the attacker has to be on-path or adjacent.

What to do

Upgrade EOS to the fixed release listed in Arista Security Advisory 0223. The record does not give the fixed versions, so check the advisory before scheduling. A switch image upgrade means draining traffic off each device in turn. Where S-BFD is not needed, disabling it removes the exposure.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-121295 https://www.arista.com/en/support/advisories-notices/security-advisory/25045-security-advisory-0223

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.