Security update for frr

Announcement ID:	SUSE-SU-2026:1063-1
Release Date:	2026-03-26T10:36:53Z
Rating:	moderate
References:	bsc#1252761 bsc#1252810 bsc#1252811 bsc#1252812 bsc#1252813 bsc#1252829 bsc#1252833 bsc#1252835 bsc#1252838 jsc#PED-14796
Cross-References:	CVE-2025-61099 CVE-2025-61100 CVE-2025-61101 CVE-2025-61102 CVE-2025-61103 CVE-2025-61104 CVE-2025-61105 CVE-2025-61106 CVE-2025-61107
CVSS scores:	CVE-2025-61099 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61099 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61099 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61100 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61100 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61100 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61101 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61101 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61101 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61102 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61102 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61102 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61103 ( SUSE ): 6.0 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61103 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61103 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61104 ( SUSE ): 6.0 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61104 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61104 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61105 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61105 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61105 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61106 ( SUSE ): 6.0 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61106 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61106 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61107 ( SUSE ): 6.0 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61107 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61107 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	openSUSE Leap 15.5 openSUSE Leap 15.6 Server Applications Module 15-SP7 SUSE Linux Enterprise Real Time 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves nine vulnerabilities and contains one feature can now be installed.

Description:

This update for frr fixes the following issues:

Security issues:

• CVE-2025-61099: NULL Pointer Dereference in FRRouting (bsc#1252838).
• CVE-2025-61100: NULL Pointer Dereference in FRRouting (bsc#1252829).
• CVE-2025-61101: NULL Pointer Dereference in FRRouting (bsc#1252833).
• CVE-2025-61102: NULL Pointer Dereference in FRRouting (bsc#1252835).
• CVE-2025-61103: NULL pointer dereference in show_vty_ext_link_lan_adj_sid() in ospf_ext.c (bsc#1252810).
• CVE-2025-61104: NULL pointer dereference in show_vty_unknown_tlv() in ospf_ext.c (bsc#1252811).
• CVE-2025-61105: NULL pointer dereference in show_vty_link_info() in ospf_ext.c (bsc#1252761).
• CVE-2025-61106: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252812).

Non-security issues:

• Fix /var/run leftovers in logrotate config file, create /var/log and /var/lib via tmpfiles.d (jsc#PED-14796).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap 15.5
  zypper in -t patch SUSE-2026-1063=1
• openSUSE Leap 15.6
  zypper in -t patch openSUSE-SLE-15.6-2026-1063=1
• Server Applications Module 15-SP7
  zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP7-2026-1063=1

Package List:

• openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)
  • libfrr0-8.5.6-150500.4.36.1
  • libfrr_pb0-debuginfo-8.5.6-150500.4.36.1
  • frr-devel-8.5.6-150500.4.36.1
  • frr-debuginfo-8.5.6-150500.4.36.1
  • frr-debugsource-8.5.6-150500.4.36.1
  • libmlag_pb0-8.5.6-150500.4.36.1
  • libfrrcares0-debuginfo-8.5.6-150500.4.36.1
  • libfrr0-debuginfo-8.5.6-150500.4.36.1
  • libfrrospfapiclient0-8.5.6-150500.4.36.1
  • libfrr_pb0-8.5.6-150500.4.36.1
  • libfrrsnmp0-8.5.6-150500.4.36.1
  • libfrrospfapiclient0-debuginfo-8.5.6-150500.4.36.1
  • libmlag_pb0-debuginfo-8.5.6-150500.4.36.1
  • libfrrfpm_pb0-debuginfo-8.5.6-150500.4.36.1
  • libfrrzmq0-debuginfo-8.5.6-150500.4.36.1
  • libfrrfpm_pb0-8.5.6-150500.4.36.1
  • libfrrcares0-8.5.6-150500.4.36.1
  • frr-8.5.6-150500.4.36.1
  • libfrrzmq0-8.5.6-150500.4.36.1
  • libfrrsnmp0-debuginfo-8.5.6-150500.4.36.1
• openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
  • libfrr0-8.5.6-150500.4.36.1
  • libfrr_pb0-debuginfo-8.5.6-150500.4.36.1
  • frr-devel-8.5.6-150500.4.36.1
  • frr-debuginfo-8.5.6-150500.4.36.1
  • frr-debugsource-8.5.6-150500.4.36.1
  • libmlag_pb0-8.5.6-150500.4.36.1
  • libfrrcares0-debuginfo-8.5.6-150500.4.36.1
  • libfrr0-debuginfo-8.5.6-150500.4.36.1
  • libfrrospfapiclient0-8.5.6-150500.4.36.1
  • libfrr_pb0-8.5.6-150500.4.36.1
  • libfrrsnmp0-8.5.6-150500.4.36.1
  • libfrrospfapiclient0-debuginfo-8.5.6-150500.4.36.1
  • libmlag_pb0-debuginfo-8.5.6-150500.4.36.1
  • libfrrfpm_pb0-debuginfo-8.5.6-150500.4.36.1
  • libfrrzmq0-debuginfo-8.5.6-150500.4.36.1
  • libfrrfpm_pb0-8.5.6-150500.4.36.1
  • libfrrcares0-8.5.6-150500.4.36.1
  • frr-8.5.6-150500.4.36.1
  • libfrrzmq0-8.5.6-150500.4.36.1
  • libfrrsnmp0-debuginfo-8.5.6-150500.4.36.1
• Server Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)
  • libmlag_pb0-8.5.6-150500.4.36.1
  • frr-debuginfo-8.5.6-150500.4.36.1
  • frr-debugsource-8.5.6-150500.4.36.1
  • libmlag_pb0-debuginfo-8.5.6-150500.4.36.1

References:

• https://www.suse.com/security/cve/CVE-2025-61099.html
• https://www.suse.com/security/cve/CVE-2025-61100.html
• https://www.suse.com/security/cve/CVE-2025-61101.html
• https://www.suse.com/security/cve/CVE-2025-61102.html
• https://www.suse.com/security/cve/CVE-2025-61103.html
• https://www.suse.com/security/cve/CVE-2025-61104.html
• https://www.suse.com/security/cve/CVE-2025-61105.html
• https://www.suse.com/security/cve/CVE-2025-61106.html
• https://www.suse.com/security/cve/CVE-2025-61107.html
• https://bugzilla.suse.com/show_bug.cgi?id=1252761
• https://bugzilla.suse.com/show_bug.cgi?id=1252810
• https://bugzilla.suse.com/show_bug.cgi?id=1252811
• https://bugzilla.suse.com/show_bug.cgi?id=1252812
• https://bugzilla.suse.com/show_bug.cgi?id=1252813
• https://bugzilla.suse.com/show_bug.cgi?id=1252829
• https://bugzilla.suse.com/show_bug.cgi?id=1252833
• https://bugzilla.suse.com/show_bug.cgi?id=1252835
• https://bugzilla.suse.com/show_bug.cgi?id=1252838
• https://jira.suse.com/browse/PED-14796