EUVD-2026-61104
GHSA-577q-25hp-pjhg
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
LLDP is Layer 2 only (AV:A); no auth or interaction required; successful buffer overflow yields full code execution on the switch (C:H/I:H/A:H).
Primary rating from Vendor (nvidia).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution.
Articles & Coverage 1
AnalysisAI
Buffer overflow in the LLDP daemon of NVIDIA Cumulus Linux enables an unauthenticated attacker with Layer 2 network adjacency to achieve code execution by sending specially crafted LLDP frames. Both the GA track (all versions through 5.16) and LTS track (through 5.11.5 and 5.9.5 respectively) are confirmed affected. No active exploitation or public proof-of-concept code has been identified at time of analysis, though CISA SSVC rates the technical impact as total given that a successful exploit yields full switch compromise.
Technical ContextAI
LLDP (Link Layer Discovery Protocol, IEEE 802.1AB) is a vendor-neutral Layer 2 protocol used ubiquitously in data center fabrics to advertise device identity, capabilities, and topology to directly connected neighbors. Cumulus Linux (CPE: cpe:2.3:a:nvidia:cumulus_linux_ga and cpe:2.3:a:nvidia:cumulus_linux_lts) is NVIDIA's Linux-based network operating system deployed on whitebox and OEM top-of-rack and spine switches. The LLDP daemon processes incoming Ethernet frames from adjacent peers; CWE-120 (classic buffer overflow) indicates the daemon copies frame-supplied TLV data into a fixed-size buffer without adequate length validation. Because LLDP operates at Layer 2 - below IP routing - no IP-layer firewall, ACL, or authentication infrastructure can filter the malicious frames; the sole trust boundary is the Layer 2 segment itself.
RemediationAI
Consult the NVIDIA product security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5817 to obtain patched release versions and upgrade instructions for both GA and LTS tracks; apply the vendor-issued patch as the primary fix. If immediate patching is not operationally feasible, disable the LLDP daemon on interfaces facing untrusted Layer 2 segments - be aware this breaks neighbor discovery and may affect network management tools, automation, and topology-aware features that depend on LLDP data. Additionally, enforce strict Layer 2 segmentation so only trusted infrastructure devices share VLAN membership with Cumulus Linux switches, and restrict switch management plane access to dedicated out-of-band management networks to limit lateral movement if a switch is compromised.
More in Cumulus Linux Ga
View allSame weakness CWE-120 – Classic Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today