Security update for frr

Announcement ID:	SUSE-SU-2026:0665-1
Release Date:	2026-02-26T15:16:25Z
Rating:	moderate
References:	bsc#1252761 bsc#1252810 bsc#1252811 bsc#1252812 bsc#1252813 bsc#1252829 bsc#1252833 bsc#1252835 bsc#1252838 jsc#PED-14796 jsc#PED-266
Cross-References:	CVE-2025-61099 CVE-2025-61100 CVE-2025-61101 CVE-2025-61102 CVE-2025-61103 CVE-2025-61104 CVE-2025-61105 CVE-2025-61106 CVE-2025-61107
CVSS scores:	CVE-2025-61099 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61099 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61099 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61100 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61100 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61100 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61101 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61101 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61101 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61102 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61102 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61102 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61103 ( SUSE ): 6.0 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61103 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61103 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61104 ( SUSE ): 6.0 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61104 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61104 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61105 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61105 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61105 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61106 ( SUSE ): 6.0 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61106 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61106 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61107 ( SUSE ): 6.0 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61107 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61107 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	Server Applications Module 15-SP7 SUSE Linux Enterprise Real Time 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves nine vulnerabilities and contains two features can now be installed.

Description:

This update for frr fixes the following issues:

• CVE-2025-61099: Fixed a NULL pointer dereference, which may lead to a DoS vulnerability. (bsc#1252838)
• CVE-2025-61100: Fixed a NULL pointer dereference, which may lead to a DoS vulnerability. (bsc#1252829)
• CVE-2025-61101: Fixed a NULL pointer dereference, which may lead to a DoS vulnerability. (bsc#1252833)
• CVE-2025-61102: Fixed a NULL pointer dereference, which may lead to a DoS vulnerability. (bsc#1252835)
• CVE-2025-61103: Fixed a NULL pointer dereference, which may lead to a DoS vulnerability. (bsc#1252810)
• CVE-2025-61104: Fixed a NULL pointer dereference, which may lead to a DoS vulnerability. (bsc#1252811)
• CVE-2025-61105: Fixed a NULL pointer dereference, which may lead to a DoS vulnerability. (bsc#1252761)
• CVE-2025-61106: Fixed a NULL pointer dereference, which may lead to a DoS vulnerability. (bsc#1252812)
• CVE-2025-61107: Fixed a NULL pointer dereference, which may lead to a DoS vulnerability. (bsc#1252813)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Server Applications Module 15-SP7
  zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP7-2026-665=1

Package List:

• Server Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)
  • libfrrfpm_pb0-debuginfo-10.2.1-150700.3.5.1
  • libfrrsnmp0-debuginfo-10.2.1-150700.3.5.1
  • libfrrzmq0-debuginfo-10.2.1-150700.3.5.1
  • frr-debuginfo-10.2.1-150700.3.5.1
  • frr-devel-10.2.1-150700.3.5.1
  • libfrr0-debuginfo-10.2.1-150700.3.5.1
  • libfrrcares0-debuginfo-10.2.1-150700.3.5.1
  • libfrr_pb0-debuginfo-10.2.1-150700.3.5.1
  • libfrrfpm_pb0-10.2.1-150700.3.5.1
  • frr-debugsource-10.2.1-150700.3.5.1
  • libfrrospfapiclient0-10.2.1-150700.3.5.1
  • libfrrospfapiclient0-debuginfo-10.2.1-150700.3.5.1
  • libfrrsnmp0-10.2.1-150700.3.5.1
  • libfrrzmq0-10.2.1-150700.3.5.1
  • libfrr0-10.2.1-150700.3.5.1
  • frr-10.2.1-150700.3.5.1
  • libfrrcares0-10.2.1-150700.3.5.1
  • libmgmt_be_nb0-10.2.1-150700.3.5.1
  • libfrr_pb0-10.2.1-150700.3.5.1
  • libmgmt_be_nb0-debuginfo-10.2.1-150700.3.5.1

References:

• https://www.suse.com/security/cve/CVE-2025-61099.html
• https://www.suse.com/security/cve/CVE-2025-61100.html
• https://www.suse.com/security/cve/CVE-2025-61101.html
• https://www.suse.com/security/cve/CVE-2025-61102.html
• https://www.suse.com/security/cve/CVE-2025-61103.html
• https://www.suse.com/security/cve/CVE-2025-61104.html
• https://www.suse.com/security/cve/CVE-2025-61105.html
• https://www.suse.com/security/cve/CVE-2025-61106.html
• https://www.suse.com/security/cve/CVE-2025-61107.html
• https://bugzilla.suse.com/show_bug.cgi?id=1252761
• https://bugzilla.suse.com/show_bug.cgi?id=1252810
• https://bugzilla.suse.com/show_bug.cgi?id=1252811
• https://bugzilla.suse.com/show_bug.cgi?id=1252812
• https://bugzilla.suse.com/show_bug.cgi?id=1252813
• https://bugzilla.suse.com/show_bug.cgi?id=1252829
• https://bugzilla.suse.com/show_bug.cgi?id=1252833
• https://bugzilla.suse.com/show_bug.cgi?id=1252835
• https://bugzilla.suse.com/show_bug.cgi?id=1252838
• https://jira.suse.com/browse/PED-14796
• https://jira.suse.com/browse/PED-266