Arista EOS: malformed IS-IS LSP PDU aborts graceful restart, causing traffic loss on restart

Impact

With IS-IS graceful restart enabled, a malformed LSP PDU makes the restart procedure end early, which removes exactly the protection graceful restart exists to provide: forwarding continuity while the control plane comes back. The practical effect is traffic loss during a restart event that operators had planned to be non-disruptive. This matters most during the maintenance windows a GPU operator uses to patch switches, because it turns a rehearsed, hitless upgrade into an outage for the racks behind that switch. Availability only; exploitation depends on a restart happening, which raises attack complexity.

Who can reach it

Unauthenticated attacker with adjacent-network access injecting a malformed IS-IS LSP, and needs a graceful restart event to coincide. No credentials required.

What to do

Install the fixed EOS version or hotfix per Arista security advisory 0160, which requires a switch reload - awkward here, since the flaw makes restarts less safe, so plan the upgrade window with the rack drained rather than relying on graceful restart. IS-IS authentication and limiting IS-IS-enabled ports reduce exposure meanwhile. Affected and fixed releases are listed only in Arista's advisory.

References

Related entries

• Linux kernel RDMA/erdma: failed destroy commands leak QPs, MRs, doorbells and resource identifiersCVE-2026-92488 · Linux kernel RDMA/erdma (QP, CQ, MR and AH teardown paths)High
• Linux kernel RDMA core: port speed query can call ethtool on an unregistering netdevCVE-2026-98359 · Linux kernel RDMA core (ib_get_eth_speed netdev registration check)High
• Linux kernel RDMA/rxe: use-after-free on multicast group when rxe_mcast_add() failsCVE-2026-98360 · Linux kernel RDMA/rxe (soft-RoCE multicast group publication)High
• Linux net/rds: use-after-free of the RDMA CM id when rdma_resolve_route() fails synchronouslyCVE-2026-99212 · Linux kernel net/rds (RDMA connection manager id ownership on route-resolve failure)High
• GRUB2 (USB device initialization): Out-of-bounds write in grub_usb_device_initialize from a malicious USB descriptorCVE-2020-25647 · GRUB2 (USB device initialization)Medium
• AMD Secure Processor PCI driver - input validation: Improper input validation in the ASP PCI driver lets a localCVE-2025-0045 · AMD Secure Processor PCI driver - input validationMedium