Cumulus Linux 5.15 Release Notes
Download all 5.15 release notes as .xls5.15.0 Release Notes
Open Issues in 5.15.0
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 4662854 | If the DSCP match is configured as “ANY,” the gNMI subscription will not show DSCP as “ANY.” The OpenConfig model supports only integer DSCP values. | 5.15.0 | |
| 4648833 | Interfaces using PAM4 DAC cables on Spectrum 4 switches and later might not come up after a link flap or reboot if auto-negotiation is not enabled. Auto-negotiation is required for PAM4 DAC cables on these switches | 5.15.0 | |
| 4608614 | When setting up SSH keys, you have to run nv config apply twice for the configuration to take effect. | 5.11.3-5.15.0 | |
| 4582679 | If a node has Suppress Route Advertisement enabled and routes are re-learned; for example, when a peer sends the route again due to route policy changes, or you enable or disable graceful shutdown, not all routes are offloaded, which might cause discrepancies in traffic. | 5.9.4-5.15.0 | |
| 4579237 | If interface statistics telemetry is running on the switch, an interface_stats_collector core file might generate during statistics collection. | 5.11.3-5.15.0 | |
| 4551249 | The NVUE service might fail during switch upgrade on Cumulus Linux 5.13.1. To work around this issue, stop the sysmonitor with the sudo systemctl stop sysmonitor command, then upgrade the switch with the nv action upgrade system packages to latest command. | 5.14.0-5.15.0 | |
| 4549896 | When you try to set a VXLAN with a bridge, you see the error sx_sdk: 22985 [BRIDGE] [ERROR ]: Port(0x200A000D)) already added to a bridge. You can safely ignore this error as it doesn’t impact switch functionality. | 5.14.0-5.15.0 | |
| 4547463 | When you try to run nv action boot-next commands during optimized image upgrade, the commands time out. This does not necessarily mean an issue occurred; the system might still be executing the action.To check that the action command completed before going to the next step to reboot the system:
| 5.14.0-5.15.0 | |
| 4535806 | After a factory reset, the switch does not clear the /var/tmp directory, which the switch uses for temporary files. | 5.14.0-5.15.0 | |
| 4535749 | The uc-discards field in the nv show interface command output is actually the number of packets discarded per queue, but it is wrongly interpreted as bytes. To work around this issue, convert the data shown in bytes to packets by multiplying by 1024 if the data is in KB, 1024x1024 if the data is in MB, and 1024x1024x1024 if the data is in GB. | 5.11.0-5.15.0 | |
| 4535699 | When you configure the RADIUS authentication order with local first and radius second, the RADIUS user is authenticated as a default user name. | 5.11.3-5.15.0 | |
| 4531960 | The GNMI Subscription to xpath interfaces/interface[name=swp61s0]/state/counters/out-pkts with a high sample interval results in an initial response of zero but in subsequent updates, the value is correct. You do not see this issue when the sample interval is 1 second. | 5.14.0-5.15.0 | |
| 4509255 | In PTP two-step, the hardware incorrectly modifies the SYNC message correction field. | 5.12.0-5.15.0 | |
| 4508830 | Cumulus Linux allows you to add bond ports of mismatched speeds (such as 10G and 25G) to the same LACP bond without error and the bond reports UP. | 5.11.2-5.15.0 | |
| 4507163 | In some cases after a package upgrade with ISSU (warm boot mode), you see continuous errors in the syslog similar to the following:NOTICE CORE_ASYNC: Error at pre send callback status [Resource is in use] | 5.11.2-5.15.0 | |
| 4501632 | NVIDIA recommends you wait for approximately 60 seconds after running nv config apply before power cycling the switch so that NVUE database has time to sync to the filesystem. | 5.14.0-5.15.0 | |
| 4495383 | NVUE configuration yaml file translation converts unset commands to set commands because the translation logic expects only set commands. | 5.13.0-5.15.0 | |
| 4495231 | If the hardware clock date is later than 2038-01-19 03:14:07 UTC, the image might fail to install due to a grub-install failure on the EFI filesystem, which is a VFAT filesystem. As a result, you see the grub prompt immediately after reboot. To work around this issue, reboot from the grub prompt to go into ONIE. From ONIE, use the date command to set a date before 2038-01-19, then run the hwclock –systohc command to add it to the hardware clock. You can then use onie-nos-install to install the image. | 5.9.0-5.15.0 | |
| 4475401 | External input such as Ctrl+\ might trigger core dumps on the serial console from /bin/login. This behavior is caused by external sources, such as console servers or automation tools, and does not reflect a fault in the operating system. As a potential result, the serial console might become unresponsive. | 5.14.0-5.15.0 | |
| 4475111 | When you try to convert a layer 3 port that is part of ECMP to a bond member, you might see a failure in the switchd logs. This issue does not have any functional impact. | 5.11.2-5.15.0 | 5.9.4 |
| 4440766 | When you try to delete a trusted ca key, Cumulus Linux shows an incorrect error message. To remove a trusted ca key, you must unset the key ID, not the key literal. | 5.13.0-5.15.0 | |
| 4423248 | If you unset an interface static IP address when the interface IP gateway is configured, the nv config apply command fails with an ifreload.service error. To work around this issue, unset both the static IP address and gateway together. | 5.9.0-5.15.0 | |
| 4423244 | When you enable, then disable adaptive routing, the BGP neighbors might go down because of an unresolved MAC address. To work around this issue, configure another attribute on the interface. | 5.9.0-5.15.0 | |
| 4423175 | When you configure an API port with a TCP port already in use, the nginx server fails to restart. | 5.13.0-5.15.0 | |
| 4413589 | A MAC-only EVPN type-2 route is wrongly advertised with the layer 3 VNI label in the BGP NLRI (Network Layer Reachability Information). Although this does not have any functional impact, it is not the desired RFC behavior. | 5.13.0-5.15.0 | |
| 4337278 | In certain cases, statically configured VXLAN entries age out after a peerlink flap. | 5.12.0-5.15.0 | |
| 4329931 | In previous releases, Cumulus Linux incorrectly allowed SyncE and PPS In features to be enabled at the same time. Upgrading systems with both features configured using NVUE to 5.12.0 or higher results in a failure to apply the startup configuration as part of the first boot of the upgraded version. To work around the issue, unset one of the features before you upgrade. | 5.12.0-5.15.0 | |
| 4309876 | When you configure an invalid switch port (swp), NVUE adds the invalid configuration instead of rejecting it. The invalid interface in the configuration does not have any functional impact. | 5.12.0-5.15.0 | |
| 4308857 | When you use tls_crlcheck in the /etc/nslcd.conf file, the optional nslcd service fails due to a missing library. | 5.9.2-5.9.3, 5.12.0-5.15.0 | 5.9.4 |
| 4294156 | After you clear the RoCE counters with the nv action clear interface command, the buffer-max-usage counters in the nv show interface command output do not show updated (cleared) values. | 5.12.0-5.15.0 | |
| 4277042 | On the NVIDIA SN5600 switch, you see low power alarms immediately after a reboot. The alarms disappear after showing up initially. Certain modules typically show low power alarms on initialization. No action is needed. | 5.12.0-5.15.0 | |
| 4249096 | Binary upgrade from Cumulus Linux 4.3.1 to 5.12.0 and later is not supported. To work around this issue, perform a binary upgrade from Cumulus Linux 4.3.1 to 5.9.0, then perform a binary upgrade from Cumulus Linux 5.9.0 to 5.12.0 or later. | 5.12.0-5.15.0 | |
| 4236419 | On the Spectrum-3 switch, the PTP offset for 25GbE fluctuates within a range of plus or minus 50 nanoseconds beyond the expected values. | 5.12.0-5.15.0 | |
| 4214678 | Changes to open telemetry configuration or export states restarts the telemetry service and resets all health metrics. | 5.12.0-5.15.0 | |
| 4177067 | When performing a package upgrade, nslcd installation might open an interactive dialog to configure nslcd.conf .To avoid this interactive dialog, set the DEBIAN_FRONTEND environment variable to noninteractive. For example:cumulus@switch:~$ sudo apt-get update | 5.11.0-5.15.0 | |
| 4154839 | When you run certain SDK commands (such as sudo sx_api_port_counter_dump_all.py or sx_api_fdb_dump) first as the cumulus user, then with sudo, you see the following error:PermissionError: Errno 13] Permission denied: ‘/tmp/python_err_log.txt’ To resolve this issue, run the rm -rf /tmp/python_err_log.txt command. | 5.11.0-5.15.0 | |
| 4142857 | The switch drops PTP packets received with extra ethernet padding and you see syslog [ptp4l.ERR] messages. | 5.10.0-5.15.0 | |
| 4139511 | When you generate the cl-support file on the Spectrum-4 switch, the following messages appear on the serial console. You can safely ignore this issue.[ 1903.595131] mlxsw_minimal 2-0048: Could not acquire lock | 5.11.0-5.15.0 | |
| 4134447 | The journal logs might include the error message ERR kernel: [ 7.453789] usb usb2-port2: connect-debounce failed. You can safely ignore this log message. | 5.11.0-5.15.0 | |
| 4129757 | If you include a comma in the BGP community list, extended community list, or large community list regex expression of a routing policy, you see error messages and FRR reload fails. Make sure the regex expression does not contain a comma. For example, instead of ^65550:([0-9]{1,2}|[1-9][1-9]):.$, specify ^65550:([0-9]|[0-9][0-9]):.$ and instead of ^65550:([0-4]{1,2}|[7-9][8-9]):.$, specify ^65550:([0-4]|[0-4][0-4]|[7-9][8-9]):.$. | 5.11.0-5.15.0 | |
| 4124376 | The SN3700C-S, SN5400, and SN5600 secure boot switch running Cumulus Linux 5.11.0 or later boots with shim 15.8 that adds entries to the SBAT revocations to prevent the switch from booting shim 15.7 or earlier (included in Cumulus Linux 5.10 and earlier). To downgrade a secure boot switch from Cumulus Linux 5.11.0 or later, or to recover a downgraded switch that does not boot, follow the steps in Downgrade a Secure Boot Switch. | 5.11.0-5.15.0 | |
| 4118970 | When running PTP, the performance for 100Gx2 and 400Gx8 can have a high offset in up to 1.5% of the sampling. | 5.11.0-5.15.0 | |
| 4105127 | Any sFlow configuration changes that require an hsflowd restart are operational only after an initial delay of 60 seconds. | 5.11.0-5.15.0 | |
| 4100629 | NVUE show command outputs show LLDP neighbor changes only after the LLDP update frequency multiplied by the hold time. | 5.11.0-5.15.0 | |
| 4082210 | When you change the CPU resource limit with the nv set service control rsyslog resource-limit cpu command, the rsyslog agent does not start. To work around this issue, increase the CPU resource limit, then restart the service manually. | 5.11.0-5.15.0 | |
| 4077921 | You cannot use package upgrade to upgrade from Cumulus Linux 5.9.2 to Cumulus Linux 5.10.1 or later. You must install the Cumulus Linux image instead. | 5.10.1-5.15.0 | |
| 4049213 | When there are routes that point to a single next hop, an ECMP entry is created in the SDK. After the single next hop from the route is removed, the ECMP entry might stay in the SDK until the time the next hop is present in the kernel. | 5.9.2-5.15.0 | |
| 4047798 | Packet distribution based on ECMP hash is not working for VXLAN on top of rack switches where it is encapped. To work around this issue, enable lag hashing with gtp-teid to distribute the VXLAN encapped packets across egress interfaces. | 5.10.0-5.15.0 | |
| 4030380 | When you roll back interface configuration to the default setting with the nv unset interface command, NVUE removes the complete entry for the interface from the /etc/network/interface file, and puts the interface in admin down. As a result, you cannot configure FEC on the interface at the lower layers. | 5.10.0-5.15.0 | |
| 4005422 | When you upgrade Cumulus Linux 5.9.1 to Cumulus Linux 5.10 or later with package upgrade, the NTP service stops. To restart the NTP service, enable, then restart the service in the VRF in which it was running with the systemctl enable ntpsec@ and systemctl restart ntpsec@ commands. | 5.10.0-5.15.0 | |
| 3985682 | On Spectrum-4 switches, multicast flows containing packets smaller than 512 bytes might not reach full line rate. Cumulus Linux supports 512 byte and larger multicast packets. | 5.10.0-5.15.0 | |
| 3966312 | When connecting the SN5xxx switch to third party test equipment (such as IXIA) using copper cables at 100GbE, 200GbE, 400GbE, or 800GbE, links do not come up. | 5.10.0-5.15.0 | |
| 3948068 | On the SN3700 and SN3700c switch, the nv show platform environment voltage command output shows a failed state for the PSU-n-12V-RAIL-OUT sensors. This is a known hardware limitation that cannot be corrected by the PSU vendor. | 5.10.0-5.15.0 | |
| 3915878 | If you configure remote syslog export through a non-default VRF, you might see repeated error logs from the rsyslog process while the switch is booting:rsyslogd: create UDP socket bound to device failed: No such device [v8.2302.0]rsyslogd: No UDP socket could successfully be initialized, some functionality may be disabled. [v8.2302.0] The logs occur because the rsyslog service starts before the networking service creates the configured VRF for syslog export. There is no functional impact with this issue. | 5.9.0-5.15.0 | |
| 3879717 | Running snmpwalk on the switch with the management IP address does not work. To work around this issue, use the localhost option (snmpwalk -v 2c -c public28 localhost 1.3.6.1.2.1.14) or create a control plane ACL whitelist rule. | 5.10.0-5.15.0 | |
| 3878394 | When ZTP runs a script that contains wget, ZTP fails and you see a message similar to the following:ZTP: ZTP DHCP: Unexpected error: ‘ascii’ codec can’t decode byte 0xe2 in position 181: ordinal not in range(128)ZTP: Script returned failure To work around this issue, use the -q option with wget. | 5.9.0-5.15.0 | |
| 3877516 | When you connect two NVIDIA switches and configure 400G speed in force mode, links don’t come up. To work around this issue, make sure auto-negotiation is always on when connecting NVIDIA to NVIDIA in PAM4. | 5.9.0-5.15.0 | |
| 3875373 | When you run the nv config apply empty command, NVUE removes the cumulus user. If you are logged in as the cumulus user when you run the nv config apply empty command, the command fails. | 5.9.0-5.15.0 | |
| 3861745 | On UEFI hardware (where the /sys/firmware/efi directory exists), using the update-grub program might generate a /boot/grub/grub.cfg that is incorrect for booting ONIE if the ONIE option is selected on the console while booting. To work around this issue, run mount LABEL=“EFI System” /boot/efi before using update-grub. | 5.9.0-5.15.0 | |
| 3855796 | When configuring a Unicast Master Table for clients, the server addresses must be reachable and the route to the destination must exist. The unicast table can have one directly-connected port for a client. This restriction is only for directly connected ports and doesn’t apply to Unicast Servers on other devices or switches. | 5.9.0-5.15.0 | |
| 3847439 | In rare cases on the Spectrum 1 switch, where a dual connected host transmits all traffic flows to only one switch in a connected MLAG pair, and the host changes behavior to hash all flows to the other MLAG switch, there might be traffic loss if the MAC FDB entry on the original switch ages out. | 5.9.0-5.15.0 | |
| 3819945 | When you connect an NVIDIA SN4410, SN4700, or SN5600 switch to any Spectrum 1, Spectrum-2, or Spectrum-3 peer switch (with four lanes) using a 4x breakout configuration and the default lanes per port setting, links do not come up. To work around this issue, provide the lanes per port configuration shown below:cumulus@switch:~$ nv set interface | 5.9.0-5.15.0 | |
| 3818545 | The terminal monitoring software SecureCRT has a known issue when running on both Windows and Mac systems where it gets stuck when monitoring the serial port of the switch as Cumulus Linux boots up. When this occurs, the serial port stops as shown below and SecureCRT is unable to receive any more serial data from the switch (it is able to transmit).Mounting dev-hugepages.mount - Huge Pages File System.. | 5.9.0-5.15.0 | |
| 3774274 | When you manually configure the /etc/cumulus/datapath/qos/qos_features.conf file without applying the QoS configuration with NVUE, running the nv config apply empty command later does not clean up the QoS configuration. If the QoS configuration includes breakout ports, the nv config apply empty command fails due to a switchd reload trigger failure. To work around this issue, clean up the configuration manually in the /etc/cumulus/datapath/qos/qos_features.conf, then run the nv config apply empty command. | 5.8.0-5.15.0 | |
| 3773177 | When you try to upgrade a switch from Cumulus Linux before 5.6.0 with package upgrade, you might see errors for expired GPG keys that prevent you from upgrading. To work around this issue, install the new keys with the following commands, then upgrade the switch.cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/c/cumulus-archive-keyring/cumulus-archive-keyring_4-cl5.6.0u5_all.deb | 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3771168 | When you perform an ISSU upgrade on a Spectrum 1 switch, the switchd service might crash. | 5.8.0-5.15.0 | |
| 3677533 | Due to resource constraints on the Spectrum 1 switch, staticd performance drops and takes longer to read static routes compared to the time BGP takes to complete a graceful restart and advertise routes and EOR to its helpers. As a result, static routes are advertised after the EOR is sent to graceful restart helpers, which delete the stale static routes and relearn them after receiving the EOR from the restarting node. Temporary traffic loss might occur. | 5.7.0-5.15.0 | |
| 3655681 | When you disable, then enable STP auto-edge on a port, the port might not transition to the operational edge even though the port does not receive bpdus. To work around this issue, configure the port as an admin-edge port. | 5.7.0-5.15.0 | |
| 3637444 | Applying an inbound control plane ACL on the eth0 management interface does not take effect. To work around this issue, apply the ACL on the mgmt interface; for example, nv set interface mgmt acl . | 5.7.0-5.15.0 | |
| 3591918 | The nv action disconnect system aaa user command does not clear all open sessions. To work around this issue, run the command as many times as the number of sessions. | 5.6.0-5.15.0 | |
| 3587393 | If you use the NVIDIA SN5600 (Spectrum-4) switch with Ixia test equipment, you might experience delayed link up due to intermittent link flaps. To work around this issue when using copper cables:
To work around this issue when using fiber cables:
| 5.6.0-5.15.0 | |
| 3556762 | On rare occasions, SPT switchover might not happen cleanly in PIM resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout. | 5.5.0-5.15.0 | |
| 3540510 | 400Gx8 ports only support traffic line rate with packets that are larger than 172 bytes. | 5.6.0-5.15.0 | |
| 3538321 | In rare cases, an STP topology change on PTP over a VLAN can result in the switch losing the slave state and one of the ports might remain in an uncalibrated state. To work around this issue, toggle the port that is in the uncalibrated state up and down so that one of the ports is selected as the slave. | 5.6.0-5.15.0 | |
| 3497622 | When you remove PSUs, then plug them back in, you might experience traffic loss and some ports might be in a down state. | 5.6.0-5.15.0 | |
| 3472163 | On a switch with the Spectrum-4 ASIC, packets that are smaller than 256 bytes are not included in multicast flows. Multicast flows support packets that are 256 bytes or larger. | 5.6.0-5.15.0 | |
| 3444490 | Migration from ONYX to Cumulus Linux is supported and tested with ONYX version 3.10.4302 GA only. | 5.6.0-5.15.0 | |
| 3442569 | When trying to access the NVUE API, user accounts authenticated with a newly-configured external service, such as TACACS, RADIUS, or LDAP, receive a 401 forbidden error. To work around this issue, after enabling a new authentication service, make sure to restart both nginx.service and nvued.service to begin authenticating users against the new authentication service. | 5.5.0-5.15.0 | |
| 3430430 | When you configure PTP on 50G ports, the offset correction might be higher, which can affect the time synchronization of the node. To work around this issue, configure PTP on 100G ports, or on 10G or 1G ports with PTP shaper enabled. | 5.5.0-5.15.0 | |
| 3424967 | sudo for TACACS+ users with privilege level 15 does not work when reaching the TACACS+ server through the default VRF. To work around this issue, specify the interface name that the default VRF uses in the vrf= setting of the /etc/tacplus_servers file or run the NVUE nv set system aaa tacacs vrf command. If you don’t run either command, a TACACS+ user with privilege level 15 can run vrf task exec default sudo … to execute the sudo command. | 5.0.0-5.15.0 | |
| 3420056 | The ADVA 5401 SFP module with hardware revision 5.01 does not come up at layer 1 when you use 10G QSA adaptors. To work around this issue, use 25G QSA adaptors. | 4.4.0-4.4.5, 5.0.0-5.15.0 | |
| 3414866 | Each VLAN is represented as a bitmap on the underlying port and when you add multiple VLANs together, Cumulus Linux iterates over the existing ones and updates the diff. However, in few corner cases, the same bitmap might be repeated again causing the following error.sx_sdk: 22985 [BRIDGE] [ERROR ]: Port(0x200A000D)) already added to a bridge You can ignore this error; it has no impact on switch functionality. | 5.6.0-5.15.0 | |
| 3362113 | If you restore an NVUE startup.yaml file or run the nv config patch command after an upgrade that includes breakout ports with QoS configuration, the NVUE configuration fails to apply. Subsequent attempts to run nv config apply fail with a message similar to Invalid config [rev_id: 11] qos config is not supported on the following invalid interface: swp1s0. Supported on swp and bond interface types. To work around this issue, run nv unset on the configured QoS settings, then apply the breakout port configuration before you configure QoS. Alternatively, you can remove the QoS configuration from the yaml file and patch it separately after applying the breakout configuration. | 5.4.0-5.15.0 | |
| 3347538 | When connecting NVIDIA-to-NVIDIA in PAM4, you must enable auto-negotiation. | 5.4.0-5.15.0 | |
| 3341214 | If you use the NVUE REST API to configure a local user with a hashed password, the user cannot log in and the /etc/nvue.d/startup.yaml file shows the password as plain text. | 5.4.0-5.15.0 | |
| 3329518 | When using TACACS+, if the /etc/nsswitch.conf file specifies passwd: files tacplus (files is listed before tacplus), a user that is present in both the local /etc/passwd file and the TACACS+ server cannot log into the switch. NVIDIA recommends that when using TACACS+, you list tacplus before files in /etc/nsswitch.conf. When using NVUE, ensure that tacacs has priority over local. | 5.4.0-5.15.0 | |
| 3327477 | If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. | 3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3326659 | If you have a large number of MAC addresses, they do not age out at the MAC ageing timeout value configured on the switch. It might take up to 30 seconds more for the MAC addresses to age out and be deleted from the hardware. To work around this issue, wait for the ageing timeout value plus 30 seconds. | 5.4.0-5.15.0 | |
| 3253218 | Auto-negotiation isn’t supported on Spectrum-2 and Spectrum-3 switches using the 1G SFP-T module; FORCE 1G is configured instead. | 5.4.0-5.15.0 | |
| 3241567 | When you apply switch configuration for the first time on a freshly booted switch and you run the nv config apply command after setting the hostname with nv set system hostname, you might see the error message Failed to start Hostname Service. To work around this issue, run the nv config apply command a second time. | 5.3.0-5.15.0 | |
| 3226506 | The l1-show eth0 command does not show port information and is not supported in this release. | 5.3.0-5.15.0 | |
| 3225117 | Occasionally, packet loss might occur on 25G ports when the link is raised without FEC. | 5.4.0-5.15.0 | |
| 3172504 | When you connect the NVIDIA SN4600C switch to a Spectrum 1 or Spectrum-3 switch with a 40GbE passive copper cable (Part Number: MC2210126-005) on edge ports 1-4 and 61-64, there is an Effective BER of 1E-12 in PHY. | 5.2.0-5.15.0 | |
| 3147782 | You cannot use NVUE to configure an SNMP view to include a subtree beginning with a period. For example:cumulus@switch:~$ nv set service snmp-server viewname cumulusOnly included .1.3.6.1.4.1.40310Error: GET /nvue_v1/service/snmp-server/viewname/cumulusOnly/included?pointers=%5B%22%2Fparameters%22%2C+%22%2Fpatch%2FrequestBody%2Fcontent%2Fapplication~1json%2Fschema%22%2C+%22%2Fpatch%2Fparameters%22%2C+%22%2Fpatch%2Fresponses%2F200%2Flinks%22%5D responded with 404 NOT FOUNDTo work around this issue, reference the OID without the preceding period ( . ) in the command. | 5.3.0-5.15.0 | |
| 3145869 | On a Spectrum-3 switch, the PTP offset in 10GbE changes between plus or minus 27. The average offset is around 7. | 5.2.0-5.15.0 | |
| 3135952 | PAM4 split cables (such as 2x100G, 4x100G, and 4x50G) do not work with a forced speed setting (when auto-negotiation is off) as the default speed enabled is for NRZ mode (such as 100G_4X). To work around this issue, set the appropriate lanes for forced speed (with auto-negotation off) with the ethtool -s swpX speed <port_speed> autoneg off lanes <no_of_lanes> command. For example:cumulus@switch:~$ sudo ethtool -s swp1 speed 100000 autoneg off lanes 2 | 5.2.0-5.15.0 | |
| 3115242 | When you configure two VNIs in the same VLAN, ifupdown2 shows a vlan added to two or more VXLANS warning, which is only issued after the VNI is already added to the bridge. This leaves the new VNI in the PVID even if there is already an existing VNI configured in that PVID. | 5.1.0-5.15.0 | |
| 3103821 | On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. | 5.2.0-5.15.0 | |
| 3084476 | After you disable traffic shaping in the /etc/cumulus/datapath/qos/qos_features.conf file, the default QOS traffic shaping configuration does not restore. To work around this issue, restart switchd. | 4.4.3, 5.0.0-5.15.0 | 4.4.4-4.4.5 |
| 3084027 | Under a high load, you might see ingress drop counters increase. The drops are classified as HwIfInDiscards in ethtool and shown as ingress_general in hardware. | 4.3.0-4.4.5, 5.0.0-5.15.0 | |
| 3071652 | On rare occasions, after you reboot or restart switchd on a Spectrum 1 switch, any 25G connections with Direct Attach Copper (DAC) cables that connect from the switch to a non-NVIDIA device might flap continuously. To work around this issue, bring the affected link administratively down for a few seconds on the non-NVIDIA device, then bring the link back up. | 4.4.4-4.4.5, 5.1.0-5.15.0 | |
| 3061656 | When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. | 5.1.0-5.15.0 | |
| 2972540 | With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts. | 5.0.0-5.15.0 | |
| 2951110 | The net show time ntp servers command does not show any output with the management VRF. | 3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.15.0 | |
| 2932083 | CVE-2021-45944 CVE-2021-45949: Multiple security issues were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which could result in denial of service and potentially the execution of arbitrary code if malformed document filesare processed Vulnerable: <= 9.27~dfsg-2+deb10u4Fixed: 9.27~dfsg-2+deb10u5 | 5.0.0-5.15.0 | 4.4.3-4.4.5 |
| 2904450 | When you run the ethtool -m or the l1-show command, the 400G interface optical values do not show. | 4.4.0-4.4.5, 5.0.0-5.15.0 | |
| 2891255 | CVE-2021-39925: Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file. Vulnerable: <= 2.6.20-0+deb10u1 Fixed: 2.6.20-0+deb10u2 | 4.0.0-4.4.1, 5.0.0-5.15.0 | 4.4.2-4.4.5 |
| 2890681 | CVE-2021-42771: relative path traversal in Babel, a set of tools for internationalising Python applications, could result in the execution of arbitrary code Vulnerable: 2.6.0+dfsg.1-1Fixed: 2.6.0+dfsg.1-1+deb10u1 | 4.0.0-4.4.1, 5.0.0-5.15.0 | 4.4.2-4.4.5 |
| 2885305 | Certain Murata PSU attributes show intermittently in the sensors command output. To work around this issue, upgrade to the latest PSU firmware on Murata. | 5.0.0-5.15.0 | |
| 2867042 | When connecting the NVIDIA SN4600 switch to another NVIDIA Spectrum switch, you must use auto-negotiation mode (not force mode); otherwise the switch might use the wrong Tx configuration. | 5.0.0-5.15.0 | |
| 2823307 | Cumuls Linux does not support a bond with more than 64 ports. Any configuration with more than 64 ports in a bond changes all ports to down when you apply the configuration. | 5.0.0-5.15.0 | |
| 2736108 | When you change the VRRP advertisement interval on the master, the master advertisement interval field in the show vrrp command output does not show the updated value. | 4.4.0-4.4.5, 5.0.0-5.15.0 | |
| 2684925 | The NVUE nv show vrf default router bgp peer command produces a 404 not found error. | 4.4.0-4.4.5, 5.0.0-5.15.0 | |
| 2671652 | In VXLAN routing environments, you might experience sub-optimal route convergence delays (longer than five seconds) when a prefix transitions to a new ECMP next-hop group. This condition might occur when a VTEP loses ECMP routes through all uplink peerings, then installs the routes through a different path, such as an MLAG peerlink. | 4.4.0-4.4.5, 5.5.0-5.15.0 |
Fixed Issues in 5.15.0
| Issue ID | Description | Affects |
|---|---|---|
| 4681608 | gNMI /system/mount-point/ xPaths unexpectedly return data for /dev. As /dev is not a persistent disk, unexpected storage monitoring alerts might be generated. | 5.14.0 |
| 4680172 | In extremely rare circumstances, during a GNMI subscription change for interface or QoS data, a Spectrum ASIC SDK health event (SX_HEALTH_FATAL: Health-Check: new failure ) is observed and the process might become unresponsive. To recover from this issue, reboot the switch. | 5.14.0 |
| 4667010 | When streaming telemetry is enabled, additional logs containing ERROR BULK_COUNTER might be generated by the switch, unexpectedly bypassing log suppression rules. | 5.12.1-5.14.0 |
| 4662494 | When there are a very large number of gNMI client subscriptions, the switch might not accept new sessions and metrics might stop generating for existing sessions. | 5.14.0 |
| 4651578 | When you configure a link flap protection threshold to 0, the value is not applied operationally and is not reflected in the nv show system link flap-protection command. | 5.14.0 |
| 4647646 | If you configure policy-based routing (PBR) rules for more than 32 interfaces, only the rules assigned to the first 32 interfaces are installed in the kernel. | 4.4.2-5.14.0 |
| 4647325 | Running the nv config save command while a diff is pending might result in unexpected nv config diff output. To work around this issue, run the nv config diff –verbose command. | 5.14.0 |
| 4643537 | The nv action clear interface command does not clear the in and out packet counters under interface/. | 5.12.1-5.14.0 |
| 4641806 | When gNMI streaming is enabled and clients are subscribed to system information such as the firmware version with xPath '/components/component[name=*]/state/firmware-version', the nv config replace command might take longer than expected to complete. | 5.14.0 |
| 4641291 | In rare circumstances, the switch stops streaming telemetry data for interface counters, buffers, or phy. | 5.13.1-5.14.0 |
| 4640126 | LLDP session flaps might result in a PTMD process crash due to a double free memory block. | 5.11.2-5.14.0 |
| 4638802 | When you attempt to set a new BGP peer group on a neighbor with a current peer group configured, NVUE fails to apply the new configuration. To work around this issue, remove the existing peer group before configuring the new one. | 5.14.0 |
| 4637200 | When more than one IPv4 and/or IPv6 addresses are configured on a remote interface, NVUE LLDP commands such as nv show interface lldp-detail only reflect one address. To work around this issue, use lldpctl to view LLDP information. For example, sudo lldpctl -d -f json swp1. | 5.9.0-5.14.0 |
| 4634976 | When you run the nv action fetch system packages key command, the command fails. To work around this issue, use the apt-key-adv –fetch-keys command instead. | 5.14.0 |
| 4633514 | When the switch processes large numbers of mroute updates in an MLAG configuration, FRR might crash. | 5.8.0-5.14.0 |
| 4629293 | The nv show system telemetry command output shows the global port but not the per destination port, which makes it look like the port configured and displayed do not match. | 5.12.1-5.14.0 |
| 4625480 | When you configure TACACS+ for the first time on a switch with the nv set system aaa tacacs enable on command, the nvued service must be restarted before TACACS+ per-command authorization can be configured with any nv set system aaa tacacs authorization} commands. | 5.11.2-5.14.0 |
| 4625452 | Trying to apply a hashed password of ‘*’ blocks access to the switch instead of rejecting the password and showing an error. | 5.12.0-5.14.0 |
| 4622487 | When you configure an exclude_users line in /etc/tacplus_nss.conf containing a long list of users, NSS lookups might fail or behave incorrectly when parsing the configuration. | 5.11.1-5.14.0 |
| 4621759 | When many BFD sessions are configured at scale, ptmd might crash when one of the BFD sessions flaps. | 5.3.1-5.14.0 |
| 4621717 | When you configure TACACS+ for the first time on a switch with the nv set system aaa tacacs enable on command, the nvued service must be restarted before TACACS+ per-command authorization can be configured with any nv set system aaa tacacs authorization} commands. | 5.14.0 |
| 4621451 | Changing the gateway interface IP address on the DHCP relay causes DHCP relay to not forward the packet. To work around this issue, restart the DHCP relay service corresponding to the VRF on which it is running. | 5.13.1-5.14.0 |
| 4618809 | When collecting streaming telemetry data for per-process information and statistics from the system, you might see false errors about unavailable process IDs in the logs. | 5.14.0 |
| 4608007 | Load interval configuration changes with the nv set system counter rates load-interval command do not take effect. | 5.14.0 |
| 4607838 | You might see convergence degradation in remote link failure scenarios due to very chatty LTTng traces. | 5.14.0 |
| 4607288 | You might see convergence degradation in a remote link failure scenario due to very chatty LTTNG traces that add logging overhead. | 5.14.0 |
| 4605303 | The downstream VNI software VXLAN encapsulation path does not derive the source IP address of the outer IP header properly. Instead of using the defined vxlan-local-tunnelip under the loopback interface, it uses the underlay interface on which the packet egresses the VTEP. In a mixed vendor environment, this might lead to a drop on the decapsulating VTEP if it is not an Nvidia Cumulus Linux switch. To work around this issue, use symmetric VNI configuration instead of downstream VNI or use downstream VNI with an unnumbered underlay. | 5.13.0-5.14.0 |
| 4601056 | The neighbor manager service memory usage increases significantly after the number of entries in the kernel neighbor table exceeds the gc_threshold. | 5.13.1-5.14.0 |
| 4597334 | NVUE shows SRv6 statistics intermittently even though static SID configuration is present. | 5.14.0 |
| 4597330 | The switch sends out IPv6 neighbor discovery (ND) router advertisement through an interface that does not have router advertisement enabled. To prevent this issue, do not change or remove the remote-as of a peer-group that is used by BGP unnumbered peers. To work around this issue, restart FRR. | 5.14.0 |
| 4597153 | When you use a gateway-interface configuration with the source IP address as the gateway interface, DHCP Relay is unable to send packets to the DHCP server after flapping the gateway interface. To work around this issue, restart the DHCP Relay service or avoid configuring the gateway interface to be same as the uplink or downlink interface on the DHCP Relay node. | 5.13.1-5.14.0 |
| 4582566 | The cnp_pg_map and roce_pg_map fields are missing in the NVUE nv show interface and nv show interface qos-roce-status commands. | 5.14.0 |
| 4579137 | TTL exceeded packets might not have the expected source IP address in the forwarding path to the destination when VRF interfaces are present on the forwarding path. | 5.13.1-5.14.0 |
| 4570105 | During initial configuration of an MLAG switch with no MLAG peer or if both MLAG peers go down and only one recovers, VXLAN traffic arriving on the MLAG switch with a local IP destination might see packet loss. | 5.13.1-5.14.0 |
| 4566678 | If you enable LACP bypass mode on a bond, the switch removes the member ports from the interface and the nv show interface command shows Error: The requested item does not exist. To work around this issue, run the nv show interface command on the member physical port. | 5.13.1-5.14.0 |
| 4562806 | When there is a very high volume of MLD traffic in a VXLAN environment, the switch CPU and control protocols might be impacted. | 5.12.0-5.14.0 |
| 4557007 | Incorrect prefix boundaries are set for traffic class, switch priority, and port groups for the qos/interfaces/interface[interface-id] metrics, which sends redundant data. | 5.14.0 |
| 4556729 | OTEL SRv6 metrics might not be sent in the correct format after a switchd service restart. | 5.14.0 |
| 4554858 | The default poll interval for on-change notifications is set to 10 seconds instead of 1 second for gNMI packet trimming metrics. | 5.14.0 |
| 4550126 | Sometimes NVUE does not show SRv6 statistics even though static SID configuration is present. | 5.14.0 |
| 4498428 | Due to a GCC update in Cumulus Linux 5.14, you might see unexpected log messages, such as BPF: Invalid name when using package upgrade to upgrade to Cumulus Linux 5.14. You can ignore these messages. | 5.14.0 |
| 4472414 | After you modify the IP address of an SVI, DHCP relay uses an old cached IP address instead of the changed IP address. This occurs because DHCP relay monitors the link state change not IP address change. | 5.11.0-5.14.0 |