CVE-2026-120221

frr: bgpd double free of peer-group Site-of-Origin when dynamic neighbors disconnect

High 8.2

Description

In FRRouting, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured ("neighbor PG soo"). Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its own when the neighbor is deleted, which happens as soon as its connection closes. The first disconnect leaves the peer-group pointing at freed memory, and the second disconnect frees it again, causing bgpd to abort and drop all BGP sessions on the router. Any host whose address falls inside the listen range can trigger this by opening and closing two TCP connections to the BGP port, without sending any BGP message and without knowing the AS number, and can repeat it each time bgpd restarts. If the peer-group has a TCP-MD5 password, only hosts that know the password can trigger it. Two ordinary flaps of legitimate dynamic neighbors have the same effect. Between the two frees, displaying the configuration ("show running-config") or establishing a dynamic neighbor also reads the freed memory, which can crash bgpd after a single disconnect. Only configurations that combine a listen range with a SoO on the same peer-group are affected.

Key facts

Published: 13 Nov 2026
Last changed: 14 Nov 2026
Assigned by: NetDEF
EPSS: 0.276% likely to be exploited in the next 30 days, higher than 20.265% of CVEs (scores for 15 Nov 2026)

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

8.2CVSS 4.0, Highfrom the CNA (NetDEF)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:A

What to do

Do not configure "neighbor <peer-group> soo" on a peer-group used by "bgp listen range". Instead, set the SoO extended community with an inbound route-map, or set "neighbor soo" on statically configured neighbors. Configuring a TCP-MD5 "password" on the peer-group limits the trigger to hosts that know the key.CNA workaround statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Vendor	Product	Versions
frrouting	frrouting	Default status: unaffected 01da2d26911c72023e71579bf4feeb707087ef50 up to but excluding * (affected); at 6a96f515760dc278147fbf802777956ba80c7edd unaffected 8.4.0 up to but excluding 10.2.7 (affected) 10.3.0 up to but excluding 10.3.5 (affected) 10.4.0 up to but excluding 10.4.6 (affected) 10.5.0 up to but excluding 10.5.6 (affected) 10.6.0 up to but excluding 10.6.3 (affected) 10.7.0 up to but excluding 10.7.2 (affected)