Security Advisory 0203 PDF

Date: November 2, 2026

Revision Date Changes
1.0 November 2, 2026 Initial release
1.1 November 3, 2026 Remove Wifi-AP from affected products to unaffected products. Move additional products from under triage to unaffected products.

The CVE-ID tracking this issue: CVE-2026-98432
CVSSv3.1 Base Score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSSv4.0 Base Score: 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
Common Weakness Enumeration: CWE-416: Use After Free
This vulnerability is being tracked by BUG2039829 (EOS), BUG2063903 (CVA & DMF), BUG2064513 (AGNI on-prem), BUG2065825 (Wi-Fi APs), BUG2065845 (CV-CUE on-prem)

Description

Arista Networks is providing this security update in response to a vulnerability affecting the use of IPv4 in the Linux kernel. It is believed to be possible to allow an unauthenticated attacker remote code execution (RCE) in the kernel if exploited. As of the time of this publication the only known means of exploiting this vulnerability requires multipath TCP (MPTCP) to be enabled in the Linux kernel.

Because of the MPTCP prerequisite, few Arista product lines are affected, but the underlying issue is present in many products. This advisory is focused on products that are known to be impacted, with Mitigation and Remediation guidance provided for other products as a defense in depth.

This issue is a publicly disclosed vulnerability in open source software, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Vulnerability Assessment

Platform and Software Applicability Note

To determine actual exposure, operators should first check their software versions against the "Affected Software" list below. If your software release is not listed, your deployment is not vulnerable, regardless of the hardware platform in use.

Affected Software

For this security advisory affected software is listing versions of software where there is an impact to the customer. As of the publication of this advisory that means that MPTCP must be enabled at the kernel level.

Arista Network Detection and Response (NDR) Security Platform

  • All versions prior to and including 5.4.11

Affected Platforms

The following products are affected by this vulnerability:
 
  • Arista Network Detection and Response (NDR) Security Platform (Formerly Awake NDR)
The following product versions and platforms are not affected by this vulnerability. Please note, at this point this is an assessment of required configuration for exploitation, ie MPTCP being enabled, not of the vulnerable ipv4 code being present. Products with vulnerable ipv4 code will have fixed releases over time:
 
  • Arista EOS-based products:
    • 710 Series
    • 720D Series
    • 720XP/722XPM Series
    • 750X Series
    • 7010TX Series 
    • 7020R/R4 Series
    • 7130 Series running EOS
    • 7170 Series
    • 7050X3/X4 Series
    • 7060X/X2/X4/X5/X6 Series
    • 7260X/X3 Series
    • 7280R/R2/R3/R4 Series
    • 7300X/X3 Series
    • 7320X Series
    • 7358X4 Series
    • 7368X4 Series
    • 7388X5 Series
    • 7500R/R2/R3 Series
    • 7800R3/R4 Series
    • 7700R4 Series
    • AWE 5000 Series
    • AWE 7200R Series
    • CloudEOS
    • cEOS-lab
    • vEOS-lab
    • CloudVision eXchange, virtual or physical appliance
  • VeloCloud Orchestrator (Formerly VeloCloud Orchestrator by Broadcom)
  • VeloCloud Gateway (Formerly VeloCloud Gateway by Broadcom)
  • VeloCloud Edge (Formerly VeloCloud Edge by Broadcom)
  • CloudVision CUE virtual appliance or physical appliance
  • CloudVision CUE cloud service delivery
  • CloudVision Appliance Software
  • CloudVision Portal, virtual appliance or physical appliance
  • Arista Converged Cloud Fabric (formerly Big Switch BCF)
  • DANZ Monitoring Fabric (DMF) - Controller Appliance
  • DANZ Monitoring Fabric (DMF) - Analytics Node Appliance
  • DANZ Monitoring Fabric (DMF) - Recorder Node Appliance
  • DANZ Monitoring Fabric (DMF) - Service Node Appliance
  • Arista Multi Cloud Director (formerly Big Switch MCD)
  • CloudVision as-a-Service
  • Wifi Access Points
  • Arista Edge Threat Management - Arista NG Firewall and Arista Micro Edge (Formerly Untangle)
  • CloudVision AGNI - Cloud service delivery
  • CloudVision AGNI - Virtual or physical appliance
The following product versions and platforms are under triage to determine if they are by this vulnerability:
 
  • Arista NetVisor OS, Arista NetVisor UNUM, and Insight Analytics (Formerly Pluribus)

Required Configuration for Exploitation

Arista Network Detection and Response (NDR) Security Platform

Configuration changes that disable MPTCP on NDR appliances are not user-operable, and will be pushed out to online NDR appliances. For offline or air-gapped appliances, please contact Arista support for assistance in applying the patches.

 

Indicators of Compromise

There are no clear indicators of compromise for this issue. Unusually high amounts of traffic containing IPv4 options or kernel crashes may indicate attempted exploitation of this issue across products.

Mitigation

Arista Network Detection and Response (NDR) Security Platform

NDR will be disabling MPTCP in all non air-gapped platforms. This action will be performed automatically by NDR SREs and no customer configuration is required. This action is expected to be completed by November 4, 2026.

 

Air-gapped systems will need to contact Arista support for assistance in applying the patches.

Resolution

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.

This section will be updated once fixed releases are available for the underlying kernel issue or to disable MPTCP.

Hotfix

No hotfix is available for these issues.

 

For More Information:

If you require further assistance, or if you have any further questions regarding this notice, please contact the Arista Networks Technical Assistance Center (TAC) by one of the following methods:

  • Open a Service Request: https://arista.com
  • By email: 该邮件地址已受到反垃圾邮件插件保护。要显示它需要在浏览器中启用 JavaScript。
  • By telephone: List of regional telephone numbers
 

Receive Notifications

Subscribe to the RSS feed and email notifications to receive periodic updates on new software releases, end of sale, end of support and field notices