Arista EOS: malformed IS-IS LSP PDU aborts graceful restart, causing traffic loss on restart

Impact

With IS-IS graceful restart enabled, a malformed LSP PDU makes the restart procedure end early, which removes exactly the protection graceful restart exists to provide: forwarding continuity while the control plane comes back. The practical effect is traffic loss during a restart event that operators had planned to be non-disruptive. This matters most during the maintenance windows a GPU operator uses to patch switches, because it turns a rehearsed, hitless upgrade into an outage for the racks behind that switch. Availability only; exploitation depends on a restart happening, which raises attack complexity.

Who can reach it

Unauthenticated attacker with adjacent-network access injecting a malformed IS-IS LSP, and needs a graceful restart event to coincide. No credentials required.

What to do

Install the fixed EOS version or hotfix per Arista security advisory 0160, which requires a switch reload - awkward here, since the flaw makes restarts less safe, so plan the upgrade window with the rack drained rather than relying on graceful restart. IS-IS authentication and limiting IS-IS-enabled ports reduce exposure meanwhile. Affected and fixed releases are listed only in Arista's advisory.

References

Related entries

• GRUB2 (USB device initialization): Out-of-bounds write in grub_usb_device_initialize from a malicious USB descriptorCVE-2020-25647 · GRUB2 (USB device initialization)Medium
• AMD Secure Processor PCI driver - input validation: Improper input validation in the ASP PCI driver lets a localCVE-2025-0045 · AMD Secure Processor PCI driver - input validationMedium
• AMD SEV firmware - RMP write during SNP initialization: A privileged attacker can write to the reverse map page duringCVE-2025-29939 · AMD SEV firmware - RMP write during SNP initializationMedium
• AMD Secure Processor PCI driver - use-after-free: A use-after-free reachable through the ASP PCI driverCVE-2025-48521 · AMD Secure Processor PCI driver - use-after-freeMedium
• IBM Power Systems FSP: authenticated admin can force a persistent degraded operating modeCVE-2026-16938 · IBM Power Systems Firmware (FSP privileged system configuration controls)Medium
• Arista EOS: crafted password creates orphan sessions until logins are exhaustedCVE-2026-19641 · Arista EOS password authentication (session handling)Medium