---
id: "CVE-2026-120221"
page: "https://infrastack.ai/live/CVE-2026-120221"
kind: "vulnerability"
aliases: ["CVE-2026-120221"]
title: "FRRouting bgpd double-frees memory on dynamic neighbor disconnect, crashing routing"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "frr", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["bgp", "bgpd", "frrouting", "routers", "runtime", "self-hosted"]
not_affected_if: ["no-listen-range", "no-soo-on-peer-group", "tcp-md5-password-unknown-hosts"]
published_at: "2026-11-13T12:17:03+00:00"
first_seen_at: "2026-11-13T13:13:30+00:00"
updated_at: "2026-11-13T13:15:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120221", "first_seen_at": "2026-11-13T13:13:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-13T13:15:45+00:00"}]
exploit_sources: []
---

# FRRouting bgpd double-frees memory on dynamic neighbor disconnect, crashing routing

Link for people: https://infrastack.ai/live/CVE-2026-120221 (this .md is for agents)

In FRRouting 8.4 and later, bgpd frees the same Site-of-Origin memory twice when dynamic BGP neighbors disconnect, if a peer-group used by a listen range also has a SoO set. A host inside the listen range can open and close two TCP connections to the BGP port and make bgpd abort, dropping all BGP sessions on the router.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:frr affected range not listed fixed no fixed version listed

## How to check

- Check version: vtysh -c 'show version'; affected is 8.4 and later (neighbor soo was added in 8.4). Fixed release not published as of 2026-11-13.
- In 'show running-config' look for both 'bgp listen range ... peer-group PG' and 'neighbor PG soo ...' on the same peer-group; both must be present.
- Check whether the listen range is reachable on TCP 179 from untrusted hosts; a TCP-MD5 password on the peer-group limits triggering to hosts that know it.

## Timeline

- 2026-11-13T13:13:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120221
- 2026-11-13T13:15:45+00:00 analyst — NVD/MITRE text only. FRR security page (frrouting.org/security) does not list this CVE yet; no fix PR or release found in GitHub/release-note searches (10.6.1 notes show nothing on SoO). Fixed version unknown; check FRRouting/frr for a bgpd soo/dynamic-neighbor fix. Nothing verified. Interim workaround: remove 'neighbor PG soo' from peer-groups used by 'bgp listen range', or restrict TCP 179 to trusted sources.

## From the sources

In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured ("neighbor PG soo"). Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its own when the neighbor is deleted, which happens as soon as its connection closes. The first disconnect leaves the peer-group pointing at freed memory, and the second disconnect frees it again, causing bgpd to abort and drop all BGP sessions on the router. Any host whose address falls inside the listen range can trigger this by opening and closing two TCP connections to the BGP port, without sending any BGP message and without knowing the AS number, and can repeat it each time bgpd restarts. If the peer-group has a TCP-MD5 password, only hosts that know the password can trigger it. Two ordinary flaps of legitimate dynamic neighbors have the same effect. Between the two frees, displaying the configuration ("show running-config") or establishing a dynamic neighbor also reads the freed memory, which can crash bgpd after a single disconnect. Only configurations that combine a listen range with a SoO on the same peer-group are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_