{"id":"CVE-2026-121295","kind":"vulnerability","aliases":["CVE-2026-121295"],"related":[],"title":"Arista EOS: crafted S-BFD packet crashes kernel and reboots switch","description":"On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device reboot.","summary":"Per the CVE text, on Arista EOS devices configured as S-BFD peers an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device, crashing its kernel and rebooting it. Affected and fixed EOS versions are not yet confirmed from Arista's advisory.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arista-eos","infrastructure","network-gear","s-bfd"],"not_affected_if":["no-s-bfd-configured","no-s-bfd-peering"],"how_to_check":"Unknown until Arista's advisory is read. Per the CVE text, only EOS devices configured as S-BFD peers (initiator side) are in scope: look for seamless BFD (S-BFD) in the running config; if absent you can likely skip it.","fix":null,"status":"open","published_at":"2026-11-10T20:18:55+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","triaged_at":"2026-11-10T20:47:21+00:00","updated_at":"2026-11-10T20:50:15+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:47:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Arista EOS: crafted S-BFD packet crashes kernel and reboots switch","impact":"medium","summary":"On Arista EOS devices configured as S-BFD peers, an unauthenticated attacker can send a crafted S-BFD PDU to an initiator device. The crafted packet crashes the kernel and causes the device to reboot unexpectedly.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["arista-eos","network-gear","s-bfd"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Initiator device kernel crashes, forcing an unexpected reboot.","analyst_note":"Confirm affected EOS versions, fixed releases and S-BFD configuration check in the Arista security advisory; NVD entry lacks product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-s-bfd-peering"],"who_is_affected":"Affected Arista EOS devices that run S-BFD (Seamless Bidirectional Forwarding Detection) as peers can be crashed by a crafted S-BFD PDU sent by an unauthenticated attacker. Networks not running Arista EOS with S-BFD peering are not affected by this description. unknown for exact affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000712,"input_tokens":4550,"output_tokens":514,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm affected EOS versions, fixed releases and S-BFD configuration check in the Arista security advisory; NVD entry lacks product ranges.","search":"'-121295':15A,18A '-2026':14A,17A 'advisori':76B 'affect':64B,78C 'arista':1A,20B,34B,74B,81C 'arista-eo':19B 'attack':45B,91C 'bfd':6A,28B,41B,52B,87C,98C 'caus':108C 'configur':37B,83C 'confirm':72B 'could':46B,92C,107C 'craft':3A,49B,95C,105C 'crash':8A,58B,116C 'cve':13A,16A,31B 'devic':36B,57B,103C,114C,121C 'eo':2A,21B,35B,67B,82C 'fix':66B 'gear':25B 'infrastructur':22B 'initi':56B,102C,113C 'kernel':9A,60B,110C 'network':24B 'network-gear':23B 'packet':7A 'pdu':53B,99C,106C 'peer':42B,88C 'per':29B 'platform':79C 'reboot':11A,62B,122C 'result':117C 'run':80C 's-bfd':4A,26B,39B,50B,85C,96C 'send':47B,93C 'switch':12A 'text':32B 'unauthent':44B,90C 'unexpect':120C 'version':68B 'yet':71B","nicknames":[],"mitigations":[],"who_affected":"Affected Arista EOS devices that run S-BFD (Seamless Bidirectional Forwarding Detection) as peers can be crashed by a crafted S-BFD PDU sent by an unauthenticated attacker. Networks not running Arista EOS with S-BFD peering are not affected by this description. unknown for exact affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aristaeos","critical","infrastructure","networkgear","sbfd"],"campaign_type":null,"search_a":"'-121295':15A,18A '-2026':14A,17A 'arista':1A 'bfd':6A 'craft':3A 'crash':8A 'cve':13A,16A 'eo':2A 'kernel':9A 'packet':7A 'reboot':11A 's-bfd':4A 'switch':12A","search_b":"'advisori':76B 'affect':64B 'arista':20B,34B,74B 'arista-eo':19B 'attack':45B 'bfd':28B,41B,52B 'configur':37B 'confirm':72B 'could':46B 'craft':49B 'crash':58B 'cve':31B 'devic':36B,57B 'eo':21B,35B,67B 'fix':66B 'gear':25B 'infrastructur':22B 'initi':56B 'kernel':60B 'network':24B 'network-gear':23B 'pdu':53B 'peer':42B 'per':29B 'reboot':62B 's-bfd':26B,39B,50B 'send':47B 'text':32B 'unauthent':44B 'version':68B 'yet':71B","search_c":"'affect':78C 'arista':81C 'attack':91C 'bfd':87C,98C 'caus':108C 'configur':83C 'could':92C,107C 'craft':95C,105C 'crash':116C 'devic':103C,114C,121C 'eo':82C 'initi':102C,113C 'kernel':110C 'pdu':99C,106C 'peer':88C 'platform':79C 'reboot':122C 'result':117C 'run':80C 's-bfd':85C,96C 'send':93C 'unauthent':90C 'unexpect':120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121295","severity":null,"published_at":"2026-11-10T20:18:55+00:00","modified_at":"2026-11-10T20:18:55+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","fetched_at":"2026-11-10T20:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121295:2712","url":"https://vuldb.com/cve/CVE-2026-121295","severity":null,"published_at":"2026-11-10T20:50:15+00:00","modified_at":"2026-11-10T20:50:15+00:00","first_seen_at":"2026-11-10T20:50:15+00:00","fetched_at":"2026-11-10T20:50:15+00:00","note":"CVE published today (Nov 10 2026, Arista CNA, CVSS 8.6, CWE-400). Arista advisory not indexed yet and arista.com blocks fetch (Client Challenge), so affected/fixed EOS versions unknown; nothing verified. Revisit for the Arista advisory (BUG id, fixed trains) and S-BFD config check. Sep 2026 Arista advisories (e.g. 0154 BFD) are different CVEs.","cites":["https://vuldb.com/cve/CVE-2026-121295","https://nvd.nist.gov/vuln/detail/CVE-2026-121295"]}],"documents":[{"id":118295,"url":"https://vuldb.com/cve/CVE-2026-121295","title":"VulDB: CVE-2026-121295 in EOS (MITRE/Arista CNA text)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":118296,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121295","title":"NVD: CVE-2026-121295","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}