Cumulus Linux 5.13 Release Notes
Download all 5.13 release notes as .xls5.13.0 Release Notes
Open Issues in 5.13.0
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 4425299 | After upgrading from Cumulus Linux 5.12 to 5.13 on the NVIDIA SN5400 switch bonus port, PTP does not converge. To work around this issue, disable, then enable the bonus port after upgrade. | 5.13.0 | |
| 4423249 | If you unset an interface static IP address when the interface IP gateway is configured, the nv config apply command fails with an ifreload.service error. To work around the issue, unset both the static IP address and gateway together. | 5.13.0 | |
| 4423248 | If you unset an interface static IP address when the interface IP gateway is configured, the nv config apply command fails with an ifreload.service error. To work around the issue, unset both the static IP address and gateway together. | 5.13.0 | |
| 4423223 | When processing the static IP assignment for an interface previously managed through DHCP, Cumulus Linux fails to clean up the DHCP created state completely. As a result when the IP address assigned by DHCP earlier expires, the switch eventually loses connectivity. | 5.13.0 | |
| 4422899 | When displaying BGP neighbor advertised routes in JSON format with very large routing tables (around 800K prefixes), the process consumes excessive memory resulting in OOM crashes. | 5.13.0 | |
| 4422898 | When displaying BGP neighbor advertised routes in JSON format with very large routing tables (around 800K prefixes), the process consumes excessive memory resulting in OOM crashes. | 5.13.0 | |
| 4413450 | When displaying BGP neighbor advertised routes in JSON format with very large routing tables, the process consumes excessive memory resulting in OOM crashes. | 5.0.0-5.13.0 | |
| 4408280 | NVUE commands can create excessive log data. To work around this issue, configure rsyslog rules to limit logging of these commands. | 5.11.0-5.13.0 | |
| 4403755 | On first boot after a binary install or upgrade, if ZTP does not run or does not complete successfully, all interfaces are left admin up until you disable ZTP manually. To work around this issue, use an empty ZTP script during onie-install (-z ZTP_URL) or configure the DCHP option 239. | 5.12.1-5.13.0 | |
| 4389433 | On switches with ONIE 5.3.0012 (might be displayed as 2023.11-5.3.0012-115200), reinstalling Cumulus Linux with onie-install when SecureBoot is enabled fails during CMS verification of a found image.To determine the ONIE version on the switch: sudo mount LABEL=“ONIE-BOOT” /mntIf the ONIE version is earlier than 5.3.0012 (might be displayed as 2023.11-5.3.0012-115200), either disable SecureBoot during reinstallation, or if SecureBoot is enabled and ONIE finds the image on one of the disks (for example, /dev/sda5), then fails CMS verification, log into the ONIE shell as root and run the following commands:onie-stop | 5.12.0-5.13.0 | |
| 4337278 | In certain cases, statically configured VXLAN entries age out after a peerlink flap. | 5.12.0-5.13.0 | |
| 4329931 | In previous releases, Cumulus Linux incorrectly allowed SyncE and PPS In features to be enabled at the same time. Upgrading systems with both features configured using NVUE to 5.12.0 or higher results in a failure to apply the startup configuration as part of the first boot of the upgraded version. To work around the issue, unset one of the features before you upgrade. | 5.12.0-5.13.0 | |
| 4309876 | When you configure an invalid switch port (swp), NVUE adds the invalid configuration instead of rejecting it. The invalid interface in the configuration does not have any functional impact. | 5.12.0-5.13.0 | |
| 4308857 | When you use tls_crlcheck in the /etc/nslcd.conf file, the optional nslcd service fails due to a missing library. | 5.9.2-5.13.0 | |
| 4280299 | The nv action fetch system packages key command fails if the key ID is an scp/ftp or URL path that requires a password to access the key. To work around this issue, use a URI that does not require password authentication for the key ID. | 5.12.0-5.13.0 | |
| 4277042 | On the NVIDIA SN5600 switch, you see low power alarms immediately after a reboot. The alarms disappear after showing up initially. Certain modules typically show low power alarms on initialization. No action is needed. | 5.12.0-5.13.0 | |
| 4249096 | Binary upgrade from Cumulus Linux 4.3.1 to 5.12.0 and later is not supported. To work around this issue, perform a binary upgrade from Cumulus Linux 4.3.1 to 5.9.0, then perform a binary upgrade from Cumulus Linux 5.9.0 to 5.12.0. | 5.12.0-5.13.0 | |
| 4236419 | On the Spectrum-3 switch, the PTP offset for 25GbE fluctuates within a range of ±50 nanoseconds beyond the expected values. | 5.12.0-5.13.0 | |
| 4214678 | Changes to open telemetry configuration or export states restarts the telemetry service and resets all health metrics. | 5.12.0-5.13.0 | |
| 4177067 | When doing a package upgrade from CL5.9 or CL5.10 to CL5.11 or later, the installation of nslcd might open an interactive dialog to configure nslcd.conf .To avoid this interactive dialog, set the DEBIAN_FRONTEND environment variable to noninteractive. For example:cumulus@switch:~$ sudo apt-get update | 5.11.0-5.13.0 | |
| 4154839 | When you run certain SDK commands (such as sudo sx_api_port_counter_dump_all.py or sx_api_fdb_dump etc) first as the cumulus user, then with sudo, you see the following error:PermissionError: Errno 13] Permission denied: ‘/tmp/python_err_log.txt’ To resolve this issue, run the rm -rf /tmp/python_err_log.txt command. | 5.11.0-5.13.0 | |
| 4142857 | The switch drops PTP packets received with extra ethernet padding and you see syslog [ptp4l.ERR] messages. | 5.10.0-5.13.0 | |
| 4139511 | When you generate the cl-support file on the Spectrum-4 switch, the following messages appear on the serial console. The issue is harmless.[ 1903.595131] mlxsw_minimal 2-0048: Could not acquire lock | 5.11.0-5.13.0 | |
| 4134447 | The journal logs might include the error message ERR kernel: [ 7.453789] usb usb2-port2: connect-debounce failed. This log message has no functionality impact and can be safely ignored. | 5.11.0-5.13.0 | |
| 4129757 | If you include a comma in the BGP community list, extended community list, or large community list regex expression of a routing policy, you see error messages and FRR reload fails. Make sure the regex expression does not contain a comma. For example, instead of ^65550:([0-9]{1,2}|[1-9][1-9]):.$, specify ^65550:([0-9]|[0-9][0-9]):.$ and instead of ^65550:([0-4]{1,2}|[7-9][8-9]):.$, specify ^65550:([0-4]|[0-4][0-4]|[7-9][8-9]):.$. | 5.11.0-5.13.0 | |
| 4124376 | The SN3700C-S, SN5400, and SN5600 secure boot switch running Cumulus Linux 5.11.0 or later boots with shim 15.8 that adds entries to the SBAT revocations to prevent the switch from booting shim 15.7 or earlier (included in Cumulus Linux 5.10 and earlier). To downgrade a secure boot switch from Cumulus Linux 5.11.0 or later, or to recover a downgraded switch that does not boot, follow the steps in Downgrade a Secure Boot Switch. | 5.11.0-5.13.0 | |
| 4118970 | When running PTP, the performance for 100Gx2 and 400Gx8 can have a high offset in up to 1.5% of the sampling. | 5.11.0-5.13.0 | |
| 4105127 | Any sFlow configuration changes that require an hsflowd restart are operational only after an initial delay of 60 seconds. | 5.11.0-5.13.0 | |
| 4100629 | NVUE show command outputs show LLDP neighbor changes only after the LLDP update frequency multiplied by the hold time. | 5.11.0-5.13.0 | |
| 4082210 | When you change the CPU resource limit with the nv set service control rsyslog resource-limit cpu command, the rsyslog agent does not start. To work around this issue, increase the CPU resource limit, then restart the service manually. | 5.11.0-5.13.0 | |
| 4077921 | You cannot use package upgrade to upgrade from Cumulus Linux 5.9.2 to Cumulus Linux 5.10.1 or later. You must install the Cumulus Linux image instead. | 5.10.1-5.13.0 | |
| 4049213 | When there are routes that point to a single next hop, an ECMP entry is created in the SDK. After the single next hop from the route is removed, the ECMP entry might stay in the SDK until the time the next hop is present in the kernel. | 5.9.2-5.13.0 | |
| 4047798 | Packet distribution based on ECMP hash is not working for VXLAN on top of rack switches where it is encapped. To work around this issue, enable lag hashing with gtp-teid to distribute VXLAN encapped packets across egress interfaces on the top of rack switches. | 5.10.0-5.13.0 | |
| 4030380 | When you roll back interface configuration to the default setting with the nv unset interface command, NVUE removes the complete entry for the interface from the /etc/network/interface file, and puts the interface in admin down. As a result, you cannot configure FEC on the interface at the lower layers. | 5.10.0-5.13.0 | |
| 4005422 | When you upgrade Cumulus Linux 5.9.1 to Cumulus Linux 5.10 or later with package upgrade, the NTP service stops. To restart the NTP service, enable, then restart the service in the VRF in which it was running with the systemctl enable ntpsec@ and systemctl restart ntpsec@ commands. | 5.10.0-5.13.0 | |
| 3985682 | On Spectrum-4 switches, multicast flows containing packets smaller than 512 bytes might not reach full line rate. Cumulus Linux supports 512 byte and larger multicast packets. | 5.10.0-5.13.0 | |
| 3966312 | When connecting the SN5xxx switch to third party test equipment (such as IXIA) using copper cables at 100GbE, 200GbE, 400GbE, or 800GbE, links do not come up. | 5.10.0-5.13.0 | |
| 3915878 | If you configure remote syslog export through a non-default VRF, you might see repeated error logs from the rsyslog process while the switch is booting:rsyslogd: create UDP socket bound to device failed: No such device [v8.2302.0]rsyslogd: No UDP socket could successfully be initialized, some functionality may be disabled. [v8.2302.0] The logs occur because the rsyslog service starts before the networking service creates the configured VRF for syslog export. There is no functional impact with this issue. | 5.9.0-5.13.0 | |
| 3879809 | What Just Happened (WJH) does not work on Spectrum-4 switches. | 5.9.0-5.13.0 | |
| 3879717 | Running snmpwalk on the switch with the management IP address does not work. To work around this issue, use the localhost option (snmpwalk -v 2c -c public28 localhost 1.3.6.1.2.1.14) or create a control plane ACL whitelist rule. | 5.10.0-5.13.0 | |
| 3878394 | When ZTP runs a script that contains wget, ZTP fails and you see a message similar to the following:ZTP: ZTP DHCP: Unexpected error: ‘ascii’ codec can’t decode byte 0xe2 in position 181: ordinal not in range(128)ZTP: Script returned failure To work around this issue, use the -q option with wget. | 5.9.0-5.13.0 | |
| 3877516 | When you connect two NVIDIA switches and configure 400G speed in force mode, links don’t come up. To work around this issue, make sure auto-negotiation is always on when connecting NVIDIA to NVIDIA in PAM4. | 5.9.0-5.13.0 | |
| 3875373 | When you run the nv config apply empty command, NVUE removes the cumulus user. If you are logged in as the cumulus user when you run the nv config apply empty command, the command fails. | 5.9.0-5.13.0 | |
| 3861745 | On UEFI hardware (where the /sys/firmware/efi directory exists), using the update-grub program might generate a /boot/grub/grub.cfg that is incorrect for booting ONIE if the ONIE option is selected on the console while booting. To work around this issue, run mount LABEL=“EFI System” /boot/efi before using update-grub. | 5.9.0-5.13.0 | |
| 3855796 | When configuring a Unicast Master Table for clients, the server addresses must be reachable and the route to the destination must exist. The unicast table can have one directly-connected port for a client. This restriction is only for directly connected ports and doesn’t apply to Unicast Servers on other devices or switches. | 5.9.0-5.13.0 | |
| 3847439 | In rare cases on the Spectrum 1 switch, where a dual connected host transmits all traffic flows to only one switch in a connected MLAG pair, and the host changes behavior to hash all flows to the other MLAG switch, there might be traffic loss if the MAC FDB entry on the original switch ages out. | 5.9.0-5.13.0 | |
| 3835635 | When adaptive routing is enabled, traffic for non adaptive routing enabled ports and non adaptive routing ECMPs might be routed over all ports in ECMP. Avoid using regular ECMPs with adaptive routing enabled on the switch. | 5.9.0-5.13.0 | |
| 3819945 | When you connect an NVIDIA SN4410, SN4700, or SN5600 switch to any Spectrum 1, Spectrum-2, or Spectrum-3 peer switch (with four lanes) using a 4x breakout configuration and the default lanes per port setting, links do not come up. To work around this issue, provide the lanes per port configuration shown below:cumulus@switch:~$ nv set interface | 5.9.0-5.13.0 | |
| 3818545 | The terminal monitoring software SecureCRT has a known issue when running on both Windows and Mac systems where it gets stuck when monitoring the serial port of the switch as Cumulus Linux boots up. When this occurs, the serial port stops as shown below and SecureCRT is unable to receive any more serial data from the switch (it is able to transmit).Mounting dev-hugepages.mount - Huge Pages File System.. | 5.9.0-5.13.0 | |
| 3774274 | When you manually configure the /etc/cumulus/datapath/qos/qos_features.conf file without applying the QoS configuration with NVUE, running the nv config apply empty command later does not clean up the QoS configuration. If the QoS configuration includes breakout ports, the nv config apply empty command fails due to a switchd reload trigger failure. To work around this issue, clean up the configuration manually in the /etc/cumulus/datapath/qos/qos_features.conf, then run the nv config apply empty command. | 5.8.0-5.13.0 | |
| 3773177 | When you try to upgrade a switch from Cumulus Linux 5.5 or earlier to 5.8.0 or later with package upgrade, you see errors for expired GPG keys that prevent you from upgrading. To work around this issue, install the new keys with the following commands, then upgrade the switch.cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/c/cumulus-archive-keyring/cumulus-archive-keyring_4-cl5.6.0u5_all.deb | 4.0.0-4.4.5, 5.0.0-5.13.0 | |
| 3771168 | When you perform an ISSU upgrade on a Spectrum 1 switch, the switchd service might crash. | 5.8.0-5.13.0 | |
| 3677533 | Due to resource constraints on the Spectrum 1 switch, staticd performance drops and takes longer to read static routes compared to the time BGP takes to complete a graceful restart and advertise routes and EOR to its helpers. As a result, static routes are advertised after the EOR is sent to graceful restart helpers, which delete the stale static routes and relearn them after receiving the EOR from the restarting node. Temporary traffic loss might occur. | 5.7.0-5.13.0 | |
| 3655681 | When you disable, then enable STP auto-edge on a port, the port might not transition to the operational edge even though the port does not receive bpdus. To work around this issue, configure the port as an admin-edge port. | 5.7.0-5.13.0 | |
| 3637444 | Applying an inbound control plane ACL on the eth0 management interface does not take effect. To work around this issue, apply the ACL on the mgmt interface; for example, nv set interface mgmt acl . | 5.7.0-5.13.0 | |
| 3591918 | The nv action disconnect system aaa user command does not clear all the open sessions. To work around this issue, run the command as many times as the number of sessions to clear all the sessions. | 5.6.0-5.13.0 | |
| 3587393 | If you use the NVIDIA SN5600 (Spectrum-4) switch with Ixia test equipment, you might experience delayed link up due to intermittent link flaps. To work around this issue when using copper cables:
To work around this issue when using fiber cables:
| 5.6.0-5.13.0 | |
| 3556762 | On rare occasions, SPT switchover might not happen cleanly in PIM resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout. | 5.5.0-5.13.0 | |
| 3540510 | 400Gx8 ports only support traffic line rate with packets that are larger than 172 bytes. | 5.6.0-5.13.0 | |
| 3538321 | In rare cases, an STP topology change on PTP over a VLAN can result in the switch losing the slave state and one of the ports might remain in an uncalibrated state. To work around this issue, toggle the port that is in the uncalibrated state up and down so that one of the ports is selected as the slave. | 5.6.0-5.13.0 | |
| 3497622 | When you remove PSUs, then plug them back in, you might experience traffic loss and some ports might be in a down state. | 5.6.0-5.13.0 | |
| 3472163 | On a switch with the Spectrum-4 ASIC, packets that are smaller than 256 bytes are not included in multicast flows. Multicast flows support packets that are 256 bytes or larger. | 5.6.0-5.13.0 | |
| 3444490 | Migration from ONYX to Cumulus Linux is supported and tested with ONYX version 3.10.4302 GA only. | 5.6.0-5.13.0 | |
| 3442569 | When trying to access the NVUE API, user accounts authenticated with a newly-configured external service, such as TACACS, RADIUS, or LDAP, receive a 401 forbidden error. To work around this issue, after enabling a new authentication service, make sure to restart both nginx.service and nvued.service to begin authenticating users against the new authentication service. | 5.5.0-5.13.0 | |
| 3430430 | When you configure PTP on 50G ports, the offset correction might be higher, which can affect the time synchronization of the node. To work around this issue, configure PTP on 100G ports, or on 10G or 1G ports with PTP shaper enabled. | 5.5.0-5.13.0 | |
| 3424967 | sudo for TACACS+ users with privilege level 15 does not work when reaching the TACACS+ server through the default VRF. To work around this issue, specify the interface name that the default VRF uses in the vrf= setting of the /etc/tacplus_servers file or run the NVUE nv set system aaa tacacs vrf command. If you don’t run either command, a TACACS+ user with privilege level 15 can run vrf task exec default sudo … to execute the sudo command. | 5.0.0-5.13.0 | |
| 3420056 | The ADVA 5401 SFP module with hardware revision 5.01 does not come up at layer 1 when you use 10G QSA adaptors. To work around this issue, use 25G QSA adaptors. | 4.4.0-4.4.5, 5.0.0-5.13.0 | |
| 3362113 | If you restore an NVUE startup.yaml file or run the nv config patch command after an upgrade that includes breakout ports with QoS configuration, the NVUE configuration fails to apply. Subsequent attempts to run nv config apply fail with a message similar to Invalid config [rev_id: 11] qos config is not supported on the following invalid interface: swp1s0. Supported on swp and bond interface types. To work around this issue, run nv unset on the configured QoS settings, then apply the breakout port configuration before you configure QoS. Alternatively, you can remove the QoS configuration from the yaml file and patch it separately after applying the breakout configuration. | 5.4.0-5.13.0 | |
| 3347538 | When connecting NVIDIA-to-NVIDIA in PAM4, you must enable auto-negotiation. | 5.4.0-5.13.0 | |
| 3341214 | If you use the NVUE REST API to configure a local user with a hashed password, the user cannot log in and the /etc/nvue.d/startup.yaml file shows the password as plain text. | 5.4.0-5.13.0 | |
| 3329518 | When using TACACS+, if the /etc/nsswitch.conf file specifies passwd: files tacplus (files is listed before tacplus), a user that is present in both the local /etc/passwd file and the TACACS+ server cannot log into the switch. NVIDIA recommends that when using TACACS+, you list tacplus before files in /etc/nsswitch.conf. When using NVUE, ensure that tacacs has priority over local. | 5.4.0-5.13.0 | |
| 3327477 | If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. | 3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.13.0 | |
| 3326659 | If you have a large number of MAC addresses, they do not age out at the MAC ageing timeout value configured on the switch. It might take up to 30 seconds more for the MAC addresses to age out and be deleted from the hardware. To work around this issue, wait for the ageing timeout value plus 30 seconds. | 5.4.0-5.13.0 | |
| 3253218 | Auto-negotiation isn’t supported on Spectrum-2 and Spectrum-3 switches using the 1G SFP-T module; FORCE 1G is configured instead. | 5.4.0-5.13.0 | |
| 3241567 | When you apply switch configuration for the first time on a freshly booted switch and you run the nv config apply command after setting the hostname with nv set system hostname, you might see the error message Failed to start Hostname Service. To work around this issue, run the nv config apply command a second time. | 5.3.0-5.13.0 | |
| 3226506 | The l1-show eth0 command does not show port information and is not supported in this release. | 5.3.0-5.13.0 | |
| 3225117 | Occasionally, packet losses might occur on 25G ports when the link is raised without FEC. | 5.4.0-5.13.0 | |
| 3172504 | When you connect the NVIDIA SN4600C switch to a Spectrum 1 or Spectrum-3 switch with a 40GbE passive copper cable (Part Number: MC2210126-005) on edge ports 1-4 and 61-64, there is an Effective BER of 1E-12 in PHY. | 5.2.0-5.13.0 | |
| 3147782 | You cannot use NVUE to configure an SNMP view to include a subtree beginning with a period. For example:cumulus@switch:~$ nv set service snmp-server viewname cumulusOnly included .1.3.6.1.4.1.40310Error: GET /nvue_v1/service/snmp-server/viewname/cumulusOnly/included?pointers=%5B%22%2Fparameters%22%2C+%22%2Fpatch%2FrequestBody%2Fcontent%2Fapplication~1json%2Fschema%22%2C+%22%2Fpatch%2Fparameters%22%2C+%22%2Fpatch%2Fresponses%2F200%2Flinks%22%5D responded with 404 NOT FOUNDTo work around this issue, reference the OID without the preceding period ( . ) in the command. | 5.3.0-5.13.0 | |
| 3145869 | On a Spectrum-3 switch, the PTP offset in 10GbE changes between +-27. The average offset is around 7. | 5.2.0-5.13.0 | |
| 3135952 | PAM4 split cables (such as 2x100G, 4x100G, and 4x50G) do not work with a forced speed setting (when auto-negotiation is off) as the default speed enabled is for NRZ mode (such as 100G_4X). To work around this issue, set the appropriate lanes for forced speed (with auto-negotation off) with the ethtool -s swpX speed <port_speed> autoneg off lanes <no_of_lanes> command. For example:cumulus@switch:~$ sudo ethtool -s swp1 speed 100000 autoneg off lanes 2 | 5.2.0-5.13.0 | |
| 3115242 | When you configure two VNIs in the same VLAN, ifupdown2 shows a vlan added to two or more VXLANS warning, which is only issued after the VNI is already added to the bridge. This leaves the new VNI in the PVID even if there is already an existing VNI configured in that PVID. | 5.1.0-5.13.0 | |
| 3103821 | On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. | 5.2.0-5.13.0 | |
| 3084476 | After you disable traffic shaping in the /etc/cumulus/datapath/qos/qos_features.conf file, the default QOS traffic shaping configuration does not restore. To work around this issue, restart switchd. | 4.4.3, 5.0.0-5.13.0 | 4.4.4-4.4.5 |
| 3084027 | Under a high load, you might see ingress drop counters increase. The drops are classified as HwIfInDiscards in ethtool and shown as ingress_general in hardware. | 4.3.0-4.4.5, 5.0.0-5.13.0 | |
| 3071652 | On rare occasions, after you reboot or restart switchd on a Spectrum 1 switch, any 25G connections with Direct Attach Copper (DAC) cables that connect from the switch to a non-NVIDIA device might flap continuously. To work around this issue, bring the affected link administratively down for a few seconds on the non-NVIDIA device, then bring the link back up. | 4.4.4-4.4.5, 5.1.0-5.13.0 | |
| 3061656 | When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. | 5.1.0-5.13.0 | |
| 2972540 | With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts. | 5.0.0-5.13.0 | |
| 2964279 | When a VNI flaps, an incorrect list of layer 2 VNIs are associated with a layer 3 VNI. The NCLU net show evpn vni detail command output shows duplicate layer 2 VNIs under a layer 3 VNI. | 3.7.15, 4.4.2-4.4.5, 5.0.0-5.13.0 | 3.7.16 |
| 2951110 | The net show time ntp servers command does not show any output with the management VRF. | 3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.13.0 | |
| 2932083 | CVE-2021-45944 CVE-2021-45949: Multiple security issues were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which could result in denial of service and potentially the execution of arbitrary code if malformed document filesare processed Vulnerable: <= 9.27~dfsg-2+deb10u4Fixed: 9.27~dfsg-2+deb10u5 | 5.0.0-5.13.0 | 4.4.3-4.4.5 |
| 2904450 | When you run the ethtool -m or the l1-show command, the 400G interface optical values do not show. | 4.4.0-4.4.5, 5.0.0-5.13.0 | |
| 2891255 | CVE-2021-39925: Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file. Vulnerable: <= 2.6.20-0+deb10u1 Fixed: 2.6.20-0+deb10u2 | 4.0.0-4.4.1, 5.0.0-5.13.0 | 4.4.2-4.4.5 |
| 2890681 | CVE-2021-42771: relative path traversal in Babel, a set of tools for internationalising Python applications, could result in the execution of arbitrary code Vulnerable: 2.6.0+dfsg.1-1Fixed: 2.6.0+dfsg.1-1+deb10u1 | 4.0.0-4.4.1, 5.0.0-5.13.0 | 4.4.2-4.4.5 |
| 2885305 | Certain Murata PSU attributes show intermittently in the sensors command output. To work around this issue, upgrade to the latest PSU firmware on Murata. | 5.0.0-5.13.0 | |
| 2867042 | When connecting the NVIDIA SN4600 switch to another NVIDIA Spectrum switch, you must use auto-negotiation mode (not force mode); otherwise the switch might use the wrong Tx configuration. | 5.0.0-5.13.0 | |
| 2823307 | Cumuls Linux does not support a bond with more than 64 ports. Any configuration with more than 64 ports in a bond changes all ports to down when you apply the configuration. | 5.0.0-5.13.0 | |
| 2736108 | When you change the VRRP advertisement interval on the master, the master advertisement interval field in the show vrrp command output does not show the updated value. | 4.4.0-4.4.5, 5.0.0-5.13.0 | |
| 2684925 | The NVUE nv show vrf default router bgp peer command produces a 404 not found error. | 4.4.0-4.4.5, 5.0.0-5.13.0 | |
| 2671652 | In VXLAN routing environments, you might experience sub-optimal route convergence delays (longer than five seconds) when a prefix transitions to a new ECMP next-hop group. This condition might occur when a VTEP loses ECMP routes through all uplink peerings, then installs the routes through a different path, such as an MLAG peerlink. | 4.4.0-4.4.5, 5.5.0-5.13.0 |
Fixed Issues in 5.13.0
| Issue ID | Description | Affects |
|---|---|---|
| 4413570 | If you run the nv show system image or cl-image-upgrade -s command during an optimized image upgrade with nv action install system image or cl-image-upgrade -a, you might see a filesystem corruption on the partition on which you are installing. This issue might cause the upgrade to appear to hang or require you to use fsck on that partition.Do not use the nv show system image or cl-image-upgrade -s command during an optimized image upgrade. Also, do not mount the filesystem on which you are installing. | |
| 4408418 | eth0 loses its IP address after the DHCP lease expires, which affects eth0 reachability through the out-of-band management device. | |
| 4408414 | Cumulus Linux does not create a cl-support file when the Prometheus service crashes on the switch. | |
| 4404714 | When using gNMI streaming, installed BGP routes show 0 (zero). | |
| 4403127 | When you use BGP prefix independent convergence (PIC) with IPv6, cl-route-check might show errors due to a discrepancy in the IPv4-mapped IPv6 SOO route string format across FRR and the kernel. This is a display-only issue and has no impact on routing functionality. | |
| 4391713 | When you enable PFC watchdog on many physical ports, you might see the following error:“ERROR intf_stats_collector.go:407 BulkCounterTransactionSet error: unable to set bulk transaction”. | |
| 4391515 | Applying telemetry configuration takes more time when there is a large number of histograms configured and each histogram instance has configured bin parameters. | |
| 4391413 | After the switch reboots or switchd.service restarts, NVUE applied ERSPAN sessions do not work if the ERSPAN destination IP address is reachable through an MLAG bond. To work around this issue, remove the ERSPAN configuration and reapply it using NVUE. | 5.11.0-5.12.1 |
| 4391394 | When using DHCP snooping , access ports do not work as trust ports or server connection ports . | 5.12.0-5.12.1 |
| 4380868 | When you unmap ports by removing the breakout configuration and some of the ports are configured for histogram collection, you see an error log from SDK as the asic-monitor continues to collect statistics even after ports are unmapped. | |
| 4380465 | When the server has an IPv4 address and its source IP address is IPv6 or the other way round, accounting logs to that server fail to send and you see the error:radclient: Can’t add new socket: Too many open sockets". Authentication goes through, only Accounting fails. | |
| 4377862 | When processing the static IP assignment for an interface previously managed through DHCP, Cumulus Linux fails to clean up the DHCP created state completely. As a result when the IP address assigned by DHCP earlier expires, the switch eventually loses connectivity. | |
| 4373436 | The snmpd service generates debugging logs of sudo calls. To work around this issue, disable sudo logging for the specific commands run by the Debian-snmp user in the /etc/sudoers.d/snmp file by adding Defaults:Debian-snmp !syslog. | 5.11.0-5.12.1 |
| 4370516 | NVUE fails when applying ERSPAN configuration on an MLAG peer. This failure occurs because ERSPAN does not support bond slave ports as analyzer ports but fails to validate the configuration. | 5.11.0-5.12.1 |
| 4363645 | If you unset an interface static IP address when the interface IP gateway is configured, the nv config apply command fails with an ifreload.service error. To work around the issue, unset both the static IP address and gateway together. | |
| 4360636 | When you assign an IP address to a VRF interface, NVUE removes the 127.0.0.1, 127.0.1.1, and ::1/128 IP addresses from VRF interfaces in the kernel. This results in traffic generated by the switch in the VRF destined to 127.0.0.1 to be sent out of the local device and onto the network. To work around this issue, when assigning an IP address to a VRF interface, also configure the following on the VRF interface to ensure that the expected functionality is maintained:nv set vrf | 5.11.0-5.12.1 |
| 4360615 | The control plane trap group counters are not associated correctly with the right trap group. | 5.11.0-5.12.1 |
| 4360360 | After optimized (two partition) upgrade rollback, the nv config apply fails as NVUE uses the existing revision ID. To work around this issue, before rebooting for rollback in a two partition upgraded switch, where the current Cumulus Linux version is earlier than 5.13.0, run sudo mv /var/lib/nvue /var/lib/nvue.saved so that in the rollback version, there are no extraneous versions of NVUE configuration that were not present before you upgraded the rollback version to the current version. | |
| 4352307 | After a factory reset, the files in the /etc/pam.d/ directory might be incorrect, causing problems with password strength checking, TACACS+, RADIUS, and LDAP. To work around this issue, run the following command:cumulus@switch:~$ sudo /usr/sbin/pam-auth-update –force –package | 5.12.0-5.12.1 |
| 4347300 | When all links go down or the switch reboots, you see next hop group churn from Zebra to the SOO next hop group. This issue might cause some convergence degradation. | 5.12.0-5.12.1 |
| 4341508 | When you configure the switch to move to warm restart mode, the message does not clearly indicate that the reboot to get the switch into warm mode is not hitless. | 5.11.0-5.12.1 |
| 4341502 | After you run the nv action upgrade system packages to latest command followed by the nv action reboot system command, nv show system reboot displays upgrade instead of one of the valid values cold, warm, or fast. | 5.11.0-5.12.1 |
| 4341501 | When the username in a 802.1X session includes the equals (=) character, the ISSU warmboot fails. Make sure that = is not part of the 802.1X session name. | 5.11.0-5.12.1 |
| 4340528 | After enabling, then disabling truncation on a SPAN session, truncated packets are still received on the SPAN destination. To work around this issue, remove the SPAN session configuration, reboot the switch, then reconfigure the SPAN session without truncation. | 5.12.0-5.12.1 |
| 4335287 | ERSPAN does not work when the ERSPAN destination IP address is reachable over SVIs and layer 2 bonds. To work around this issue, make the ERSPAN destination IP address reachable over layer 3 swps or bond interfaces. | 5.11.0-5.12.1 |
| 4335117 | Under rare circumstances, firmware on an NVIDIA SN3700 switch can get locked up, which leads to the switchd process going down. | 5.12.0-5.12.1 |
| 4328029 | If you apply an NVUE snippet affecting the /etc/cumulus/datapath/traffic.conf file, the snippet might fail the consistency check, resulting in a failed snippet apply. | 5.11.0-5.12.1 |
| 4320729 | When toggling the bridge binding flag on an SVI from ON to OFF, the SVI might not come operationally UP if it was DOWN previously from the bridge binding flag. | 5.11.0-5.12.1 |
| 4318464 | When connecting two NVIDIA devices using DAC in Auto-Neg mode with 100GbE R1 (one lane) port speed, the link will go down. To avoid this, make sure to use firmware version xx.2014.3xxx and above on both sides. | 5.12.0-5.12.1 |
| 4291993 | After upgrading Cumulus Linux with optimized (two partition) image upgrade the second time, the ssh and nginx services do not start. To work around this issue, before rebooting to upgrade, check if the cumulus-upgrade-on-shutdown service is active (exited) with the systemctl status cumulus-upgrade-on-shutdown command. If the command output shows inactive (dead)), run the following commands to ensure that a subsequent two partition upgrade correctly uses the cumulus-upgrade-on-shutdown service:cumulus@switch:~$ sudo systemctl enable cumulus-upgrade-on-shutdown | 5.12.0-5.12.1 |
| 4291970 | When you enable NVUE pagination with the nv set system cli pagination state enabled command, even short outputs become paginated inside less even though they fit the terminal. If you want to see pagination only for CLI outputs larger than the terminal size, set nv set system cli pagination state to auto. | 5.12.0-5.12.1 |
| 4290634 | When you run the nv show interface counters command, there is a delay in showing the output. | 5.12.0-5.12.1 |
| 4287285 | Due to unsupported EVPN BUM replication configuration (a mix of PIM and HER modes), a resource leak can occur. | 5.11.0 |
| 4278822 | CVE-2024-3596: CL RADIUS susceptible to collision attack against MD5 R/A signature. | 5.9.2-5.11.0, 5.12.0-5.12.1 |
| 4271311 | On the NVIDIA SN2010 and SN2100 switches, the management interface (eth0) might negotiate 100M instead of 1G after you install, upgrade, or, reboot Cumulus Linux. To resolve this issue, force the speed to 1G:cumulus@switch:~$ nv set interface eth0 link speed 1G | 5.11.0 |
| 4271264 | When a MAC address flaps between two different EVPN VTEPs, a Zebra core crash occurs. | 5.11.0-5.12.1 |
| 4270240 | Statically configured VXLAN FDB entries do not age out. | 5.12.0-5.12.1 |
| 4262224 | When you configure BGP suppress-fib-pending, the prefix might not be withdrawn from downstream peers. | 5.11.0-5.12.1 |
| 4261676 | When sending control packets that have the port range 259 through 1023 in their TX base header system target (above cap_max_system_ports and below cap_ports used for LAG forwarding), a health event of a fatal cause occurs in the switch. The port range 259 through 1023 reflects illegal system ports; do not set these values in the control packet TX base header. | 5.11.0 |
| 4257386 | NVUE overwrites the MOTD file during NVUE configuration with no option to ignore it | 5.11.0 |
| 4255639 | When all links go down or the switch reboots, you see next hop group churn from Zebra to the SOO next hop group. This issue might cause some convergence degradation. | 5.12.0-5.12.1 |
| 4215613 | After a remote link flap, neighbor entries using the link might not get resolved immediately. Only when some traffic uses the nexthop will they be resolved. | 5.12.0-5.12.1 |
| 4210596 | After a factory reset, the files in /etc/pam.d/* may be incorrect, causing problems with password strength checking, TACACS+, RADIUS, and/or LDAP. To work around this issue, run the following command:cumulus@switch:~$ sudo /usr/sbin/pam-auth-update –force –package | 5.12.0-5.12.1 |
| 4207037 | NVUE Rest API calls that are authenticated with TACACS on the switch append unnecessary database entries to the /run/tacacs_clent_map file, which increases the file size. Over time, this increases the TACACS login authentication time, resulting in delayed login authentication.To work around this issue, delete the tacacs_client_map file with the sudo rm rf /run/tacacs_client_map command. | 5.11.0 |
| 4144021 | Shutting down port 65 or 66 on the NVIDIA Spectrum-4 switch leaves the opposite port up when using MLNX SFP-T and RJ45 connections. Spectrum-4 switches do not support SFP-T modules on ports 65 and 66. | 5.10.0-5.12.1 |
| 4128952 | Cumulus Linux does not support LDAP over IPv6. | 5.11.0-5.12.1 |
| 4128912 | When you use PPS IN, PTP might show a high offset. The offset might be around an offset value. For example, around 60 ns or 80 ns. To work around this issue, set the cable compensation value. For 60 ns, run the nv set platform pulse-per-second in timestamp-correction -60 command to set the compensation. | 5.11.0-5.12.1 |
| 4048583 | If there are failures in MSTPD or a port is not updated in the database, the NVUE nv show bridge domain command might not work and might produce errors even when STP has data for other working ports or VLANs. This is a display issue only and does not impact functionality. | 5.10.0-5.12.1 |
| 4019256 | If you change the switch hostname, the histogram data producer service restarts. | 5.10.0-5.12.1 |