Arista EOS: IPsec tunnels re-established with stale SAs cause sequence mismatch and unstable traffic

CVSS 8.2CVE-2026-2379Firmware, BMC & network fabriccurated

Impact

On Arista platforms with hardware IPsec support and certain IPsec features enabled, a physical interface flap or an agent restart can bring a tunnel back up against already-existing Security Associations, leaving the two endpoints with mismatched sequence numbers and unstable communication across the tunnel. The practical effect for an operator is an encrypted link that silently stops carrying traffic reliably after an ordinary event - a link flap - with no configuration change to point at. Where IPsec carries inter-site or inter-datacenter traffic, that is storage replication and distributed training traffic degrading or dropping, and the trigger is something an attacker can often induce remotely by forcing a flap. Arista's record describes availability and confidentiality-of-session impact, not code execution.

Who can reach it

No authentication described; the condition is triggered by an interface flap or an agent restart on the affected switch, which an attacker able to influence the link - or any routine operational event - can cause. Only platforms with hardware IPsec support and the affected IPsec features enabled are exposed.

What to do

Apply the fixed EOS release or the hotfix listed in Arista security advisory 0134 for your platform. EOS upgrades reload the switch unless the advisory's hotfix path applies, so treat it as a per-device maintenance window on fabric or edge switches; check the advisory for whether a hitless hotfix is offered for your train. If you cannot patch soon, know that a tunnel showing this condition is recovered by clearing the stale SAs, and watch for flap-correlated tunnel instability.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-2379 https://www.arista.com/en/support/advisories-notices/security-advisory/23419-security-advisory-0134

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.