# CVE-2026-120221: frr: bgpd double free of peer-group Site-of-Origin when dynamic neighbors disconnect

Status: published. Published: 2026-11-13. Updated: 2026-11-13.

In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured ("neighbor PG soo"). Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its own when the neighbor is deleted, which happens as soon as its connection closes. The first disconnect leaves the peer-group pointing at freed memory, and the second disconnect frees it again, causing bgpd to abort and drop all BGP sessions on the router. Any host whose address falls inside the listen range can trigger this by opening and closing two TCP connections to the BGP port, without sending any BGP message and without knowing the AS number, and can repeat it each time bgpd restarts. If the peer-group has a TCP-MD5 password, only hosts that know the password can trigger it. Two ordinary flaps of legitimate dynamic neighbors have the same effect. Between the two frees, displaying the configuration ("show running-config") or establishing a dynamic neighbor also reads the freed memory, which can crash bgpd after a single disconnect. Only configurations that combine a listen range with a SoO on the same peer-group are affected.

## Remediation

- workaround: Do not configure "neighbor <peer-group> soo" on a peer-group used by "bgp listen range". Instead, set the SoO extended community with an inbound route-map, or set "neighbor soo" on statically configured neighbors. Configuring a TCP-MD5 "password" on the peer-group limits the trigger to hosts that know the key. (source: CNA: NetDEF)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: NetDEF) — https://github.com/FRRouting/frr/pull/21685/changes/6a96f515760dc278147fbf802777956ba80c7edd

## Affected products and versions

- frrouting / frrouting: ≥ 01da2d26911c72023e71579bf4feeb707087ef50; < * (affected, git); unaffected at 6a96f515760dc278147fbf802777956ba80c7edd. Source: CNA: NetDEF

## Severity and prioritization

- CVSS 4.0: 8.2 (high); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:A; source: CNA: NetDEF

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-415, CWE-416

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/FRRouting/frr/pull/21685/changes/6a96f515760dc278147fbf802777956ba80c7edd (CNA: NetDEF; patch)

## Provenance

- CNA: NetDEF: https://www.cve.org/CVERecord?id=CVE-2026-120221; retrieved 2026-11-13; source updated 2026-11-13

Revision: 6a50218e496a99d72fa4cfa3af8913d5463264099f34d96208aef7d8874048fc

Canonical: https://y2.dev/cve/CVE-2026-120221

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.