layout-3layout-6layout-1layout-top
NVIDIA Docs Hubchevron_right NVIDIA Networkingchevron_right Networking Softwarechevron_right Switch Softwarechevron_right

Cumulus Linux

layout-toplayout-6layout-1

Cumulus Linux 5.17 Release Notes

Download 5.17 Release Notes xls    Download all 5.17 release notes as .xls

5.17.0 Release Notes

Open Issues in 5.17.0

Issue IDDescriptionAffectsFixed
5157264When you enable VRF leaking by manually attaching export RTs to the layer 2 VNI, the remote side ends up importing an EVPN type-2 route with an IPv6 link local address in the tenant VRF. These routes do not have a valid router MAC address, which is essential for layer 3 traffic forwarding in the tenant VRF and layer 3 VNI.5.16.0-5.16.1, 5.16.5-5.17.0
5145975Running simultaneous vtysh commands and FRR reload or restart commands might miss or corrupt the configuration datastore.5.16.5-5.17.0
5145963The Date-Time column in the nv show interface telemetry histogram … snapshot output shows the same timestamp for every snapshot row when you set monitor temporality to cumulative. Each snapshot now displays the actual capture time.5.16.1, 5.16.5-5.17.0
5102853In high scale configurations, you might see a configuration datastore miss or corruption when you run simultaneous vtysh commands and FRR reload or restart commands.5.16.5-5.17.0
5093941Layer 3 multicast traffic does not forward when OMF (Optimized Multicast Flooding) and PIM is enabled. To work around this issue, flap the router port.5.9.2-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093940Layer 3 multicast traffic does not forward when OMF (Optimized Multicast Flooding) and PIM is enabled. To work around this issue, flap the router port.5.9.2-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093939When nvued.log triggers log rotation, it also forces rotation of all three logs (nvued, nv-cli, and nv-api). As a result, the nv-cli logs are rotated unnecessarily, which might eventually lead to missing nv-cli.log entries due to excessive rotations.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093938When nvued.log triggers log rotation, it also forces rotation of all three logs (nvued, nv-cli, and nv-api). As a result, the nv-cli logs are rotated unnecessarily, which might eventually lead to missing nv-cli.log entries due to excessive rotations.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093933When you configure dynamic NAT and traffic enters the switch on a bridge port that is routed through a VLAN SVI (the standard MLAG bridge topology), NAT flows are not offloaded to the ASIC. An upstream kernel change clears an internal flag during the bridge-to-host handoff that the NAT offload path depends on to signal the hardware. As a result, all dynamic NAT flows fall back to software forwarding on the CPU, reducing throughput by over 99%. Static NAT and deployments using direct layer 3 ports (no bridge) are not affected.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093931When you configure dynamic NAT and traffic enters the switch on a bridge port that is routed through a VLAN SVI (the standard MLAG bridge topology), NAT flows are not offloaded to the ASIC. An upstream kernel change clears an internal flag during the bridge-to-host handoff that the NAT offload path depends on to signal the hardware. As a result, all dynamic NAT flows fall back to software forwarding on the CPU, reducing throughput by over 99%. Static NAT and deployments using direct layer 3 ports (no bridge) are not affected.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093926Configuring ECMP Hash seed with NVUE does not program the configuration into hardware with a switchd reload.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093924Certain platforms with a SATA disk for NCQ might cause IO errors sending the SSD into read-only mode. You might see ports going down until the switch reboots. There is no observable performance impact due to this issue.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093923Certain platforms with a SATA disk for NCQ might cause IO errors sending the SSD into read-only mode. You might see ports going down until the switch reboots. There is no observable performance impact due to this issue.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093919In an MLAG configuration with PVRST spanning tree mode configured on both switches, when the primary switch comes back up after a reboot, PVRST mode briefly changes to RSTP, then back to PVRST.5.13.1-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093917If the switch filesystem is overloaded or memory is exhausted, you see very slow responses from the filesystem and the SDK might fail with a fatal error similar to:
sxd_kernel: Health-Check: new failure (dev=1, severity=‘Fatal’, cause=10 [‘SDK thread issue’], irisc=255, desc=‘Health check: SDK thread [sxSniffer] TID [0x7f81cffff6c0] bit [4] does not respond [5] seconds’)
5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093874When you configure PTP on a trunk interface, where the selected PTP VLAN is the PVID (untagged native VLAN), the PTP packets might be tagged incorrectly with the VLAN ID.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093873When you configure BGP dynamic neighbors and default-originate with a route map, the default route stops being advertised to those neighbors after an FRR restart, reboot, or after the BGP session re-establishes (after a link flap or a hard clear on the peer). To work around this issue and to ensure that the default route advertises correctly, remove, then readd the default-originate with the route map command or toggle default-route-origination off, then on.5.11.5-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093865Known registered multicast traffic is duplicated to receivers behind an EVPN-MH dual-homed access switch.5.16.0-5.16.1, 5.16.5-5.17.0
5093864Known registered multicast traffic is duplicated to receivers behind an EVPN-MH dual-homed access switch.5.16.0-5.16.1, 5.16.5-5.17.0
5093853When the switch processes large numbers of mroute updates in an MLAG configuration, FRR might crash.5.8.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5093852When the switch processes large numbers of mroute updates in an MLAG configuration, FRR might crash.5.8.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
5057192With svi-force-up enabled, the SVI link state is unexpectedly NO-CARRIER and LOWERLAYERDOWN when all VLAN member ports are down. This results in loss of reachability to IP addresses configured on SVIs. To work around this issue, add and apply vlan-bridge-binding off to each SVI with a snippet; for example:
- set:

   system:

     config:

       snippet:

         ifupdown2_eni:

           vlanXXX: |

             vlan-bridge-binding off
5.16.0-5.16.1, 5.16.5-5.17.0
5057191With svi-force-up enabled, the SVI link state is unexpectedly NO-CARRIER and LOWERLAYERDOWN when all VLAN member ports are down. This results in loss of reachability to IP addresses configured on SVIs. To work around this issue, add and apply vlan-bridge-binding off to each SVI with a snippet; for example:
- set:

   system:

     config:

       snippet:

         ifupdown2_eni:

           vlanXXX: |

             vlan-bridge-binding off
5.16.0-5.16.1, 5.16.5-5.17.0
5056648During the very fist linkup process, the port enters a CLOSE state and remains there because the micro-controller takes more time to respond.5.16.1, 5.16.5-5.17.0
5045504After you enable BFD offload, BFD control packet counters stop incrementing. Control plane BFD sessions are not affected by this issue and there is no BFD functionality impact in case of kernel offload.5.16.0-5.16.1, 5.16.5-5.17.0
5025704When you set or change a password that contains a username, you see a misleading password validation error.5.17.0
5025459During FRR shutdown (reboot or upgrade), zebra might crash. There is no impact on normal switch operation or the data plane. The switch comes up cleanly after reboot.5.16.5-5.17.0
5024254When you apply an incorrect VLAN configuration to peer link bond member ports on the secondary MLAG switch, the MLAG peer link goes down and peer link member ports on both the primary and secondary MLAG switch go into a protodown state. The switch does not recover after NVUE rolls back the misconfiguration. To work around this issue (to restore the peer link and clear the protodown state), run the ifreload -a command or reboot the switch.5.16.1, 5.16.5-5.17.0
4996657On the Spectrum-3 switch, you might see changes in the lossy headroom extra threshold as a negative value.5.17.0
4993970Under certain conditions, AAA authentication restriction lockout attempts might not lock TACACS users out for failed REST API logins.5.17.0
4992289After optimized image upgrade, the SSH service fails and NVUE shows an error Failed to translate the startup configuration, will continue with the original startup.5.17.0
4990537After you run the nv action clear system link flap-protection violation command, the clear status does not show for each interface. This is a display issue and does not impact functionality.5.17.0
4988127Under certain conditions, AAA authentication restriction lockout attempts might not lock TACACS users out for failed REST API logins.5.17.0
4986343PTM does not refresh certain entries and the PTM’s neighbor status command (ptmctl -d) continues to show a neighbor that is already gone. This condition clears when the expected neighbor gets discovered.5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4986333LLDP session flaps might result in a PTMD process crash due to a double free memory block.5.11.2-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4986329When many BFD sessions are configured at scale, ptmd might crash when one of the BFD sessions flaps.5.3.1-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4964154When you run the nv config apply command or the sudo systemctl reload frr.service command on a switch configured with VRF route leaking that has many BGP peers, VRFs, and BGP learned prefixes, FRR reload might time out. To work around this issue, run sudo systemctl edit frr.service to change the TimeoutSec=2m to a higher value and apply the changes with sudo systemctl daemon-reload.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4963280Under certain scale scenarios, the switch might end up in a state where the PTM component’s connection to LLDP breaks. This issue results in LLDP socket contention issues and, in turn, a PTM memory leak.5.9.1-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4963277When many BFD sessions are configured at scale, ptmd might crash when one of the BFD sessions flaps.5.3.1-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4963271PTM does not refresh certain entries and the PTM’s neighbor status command (ptmctl -d) continues to show a neighbor that is already gone. This condition clears when the expected neighbor gets discovered.5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4957546With svi-force-up enabled, the SVI link state is unexpectedly NO-CARRIER and LOWERLAYERDOWN when all VLAN member ports are down. This results in loss of reachability to IP addresses configured on SVIs. To work around this issue, add and apply vlan-bridge-binding off to each SVI with a snippet; for example:
- set:

   system:

     config:

       snippet:

         ifupdown2_eni:

           vlanXXX: |

             vlan-bridge-binding off
5.16.0-5.16.1, 5.16.5-5.17.0
4891440The nv show interface qos-roce-status command causes HIGH CPU. nv otel service causes high cpu, competes with the BFD workers scheduled on same core.5.16.0-5.16.1, 5.16.5-5.17.0
4881770On an 802.1x port with dynamic VRF enabled, the switch might not restore the port correctly to the configured VRF after the supplicant deauthenticates and the dynamic VRF is removed. To work around this issue and to restore the port VRF configuration correctly, run the sudo ifreload -a command after the supplicant is deauthenticated.5.16.0-5.16.1, 5.16.5-5.17.0
4875306Fixed traffic drops on SLAAC and 802.1x interfaces by deferring UNREACH withdrawal until the first host actually resolves through ARP or NDP, instead of withdrawing immediately on linkup.5.16.0-5.16.1, 5.16.5-5.17.0
4871161If you use NVUE commands to change the BGP autonomous system number (ASN) for existing VRFs without deleting the associated EVPN VNI, FRR reload fails and shows an error during nv config apply. Be sure to delete the layer 3 VNI before changing the BGP ASN or restart FRR after the AS change.5.9.1-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4840299If you use NVUE commands to change the BGP autonomous system number (ASN) for existing VRFs without deleting the associated EVPN VNI, FRR reload fails and shows an error during nv config apply. Be sure to delete the layer 3 VNI before changing the BGP ASN or restart FRR after the AS change.5.9.1-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4804084On switches at scale with OTEL enabled, an interface_stats_collector crash might occur with the following logs:
interface_stats_collector[3429270]: ERROR
 buffer_stats_collector.go:1875 SDK bulk counter read failed
interface_stats_collector[3429270]: fatal error: concurrent map iteration and map write
interface_stats_collector[3429270]: goroutine 5610 gp=0xc007814c40 m=16 mp=0xc000552808 [running]:
5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4776471In Cumulus Linux 5.15.0, NTP and DNS configuration commands changed from nv set service to nv set system. However, after upgrading the switch to Cumulus Linux 5.15.1, the nv set service command might still appear in the configuration output because a stale nv set service command remains after the configuration is translated during the upgrade. If you save the configuration with the nv config show -o commands, then reapply the configuration with nv config replace, the command fails if the stale nv set service command is present.
To workaround this issue, before applying the configuration with nv config replace, remove any stale nv set service commands from the saved configuration file, then reapply the configuration with the nv config replace command.		5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4774686, 4764590The final hop does not respond to traceroute with the layer 4 protocol set to TCP or UDP.5.16.0-5.16.1, 5.16.5-5.17.0
4771988, 4958439After you enable BFD offload, BFD control packet counters stops incrementing. Control plane BFD sessions are unaffected by this issue.5.16.0-5.16.1, 5.16.5-5.17.0
4722680If you install RADIUS client packages when rolling back a two partition upgrade, the /var/lib/nvue, /var/lib/ntpsec, and /var/lib/snmp directories might have incorrect ownership after rollback and the nvued service might fail to start up. To work around this issue, run the following commands:
sudo chown -R nvue /var/lib/nvue
sudo chown -R ntpsec /var/lib/ntpsec
sudo chown -R Debian-snmp /var/lib/snmp
sudo reboot
5.11.4-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4717494When you run the nv show vrf default router rib command, NVUE returns an ItemDoesNotExist error. To work around this issue, run the following commands to retrieve IPv6 routing information:
nv show vrf default router rib ipv6
nv show vrf default router rib ipv6 route
5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4717493When you run the nv show vrf default router rib command, NVUE returns an ItemDoesNotExist error. This error occurs because the vtysh show ip route vrf default brief json command does not return any output, which propagates through NVUE. To work around this issue, run the nv show vrf default router rib ipv6 and nv show vrf default router rib ipv6 route commands instead.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4667792Usernames longer than 32 characters do not authenticate against the switch. Avoid using long usernames.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4662854If you configure a DSCP match as ANY, the gNMI subscription does not show DSCP as ANY. The OpenConfig model supports only integer DSCP values.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4657192, 4414675On the NVIDIA SN5640 switch, after you configure a port as unsplit, links do not come up while optics are in use. To work around this issue, use copper cables.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4648833, 4662556, 4687350Interfaces using PAM4 DAC cables on switches with Spectrum-4 and later might not come up after a link flap or reboot if auto-negotiation is disabled. Auto-negotiation is required for PAM4 DAC cables on these switches.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4641344The switch sends out IPv6 neighbor discovery (ND) router advertisement through an interface that does not have router advertisement enabled. To prevent this issue, do not change or remove the remote-as of a peer-group that is used by BGP unnumbered peers. To work around this issue, restart FRR.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4641343The switch sends out IPv6 neighbor discovery (ND) router advertisement through an interface that does not have router advertisement enabled. To prevent this issue, do not change or remove the remote-as of a peer-group that is used by BGP unnumbered peers. To work around this issue, restart FRR.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4608614When setting up SSH keys, you have to run nv config apply twice for the configuration to take effect.5.11.3-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4582679If a node has Suppress Route Advertisement enabled and routes are re-learned; for example, when a peer sends the route again due to route policy changes, or you enable or disable graceful shutdown, not all routes are offloaded, which might cause discrepancies in traffic.5.9.4-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4579237, 4579234If interface statistics telemetry is running on the switch, an interface_stats_collector core file might generate during statistics collection.5.11.3-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4551249, 4572507, 4573399, 4712858, 4919013The NVUE service might fail during switch upgrade. To work around this issue, stop the sysmonitor with the sudo systemctl stop sysmonitor command, then upgrade the switch with the nv action upgrade system packages to latest command.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4549896When you try to set a VXLAN with a bridge, you see the error sx_sdk: 22985 [BRIDGE] [ERROR ]: Port(0x200A000D)) already added to a bridge. You can safely ignore this error.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4548512When a connected route for an SVI interface with VRR configured is installed by FRR, the route might be installed with the next hop interface of the VRR device instead of the SVI. For example, instead of interface vlan10, the route might install against vlan10-v0. This prevents next-hop tracking and route installation into hardware.
This issue can occur under the following conditions:
  • When initially configuring VRF route leaking, the target VRF might not install a route into hardware when leaking directly connected routes for SVI interfaces with VRR enabled.
  • In an MLAG and VRR configuration, static routes fail to install when the route is resolved through a connected route and the interface of the connected route undergoes a link state change, such as a link flap, interface bring up, clagd restart, switchd restart, and so on.

To work around this issue, restart the FRR service with the sudo systemctl restart frr.service command.		5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4547463, 4705370When you try to run nv action boot-next commands during optimized image upgrade, the commands time out. This does not necessarily mean an issue occurred; the system might still be executing the action.
To check that the action command completed before going to the next step to reboot the system:
  1. Find the Request ID for the REST API invocation corresponding to the nv action boot-next command by doing a grep for ActionKey.*boot-next in the /var/log/nvued.log file. For example, the value 3 in the Ran Job running ActionKey('@boot-next', ‘/system/image’, (), 3, ((‘partition’, ‘partition1’),)) line indicates the Request ID.
  2. Run the curl -u ‘:<password>’ -X GET https://127.0.0.1:8765/nvue_v1/action/ -k command from the shell to show the status of the action command. If the value of state is action_success, the action command completed successfully. If the value of state is running, the system is still processing. If the value of state is action_error, the system encountered an error.
5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4535856When you try to import an invalid server certificate file, Cumulus Linux does not import the certificate file but fails to show an error message.5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4535806After a factory reset, the switch does not clear the /var/tmp directory, which the switch uses for temporary files.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4535804If you use a bridge name other than br_default, PTP neighbors fail to establish because the PTP packets are sourced from an unexpected IP address.
To work around this issue, configure the base-interface for the VLAN interface with the nv set interface base-interface command.		5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4535749The uc-discards field in the nv show interface counters qos egress-queue-stats command output is actually the number of packets discarded per queue, but it is wrongly interpreted as bytes. To work around this issue, convert the data shown in bytes to packets by multiplying by 1024 if the data is in KB, 1024x1024 if the data is in MB, and 1024x1024x1024 if the data is in GB.5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4535699When you configure the RADIUS authentication order with local first and radius second, the RADIUS user is authenticated as a default user name.5.11.3-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4535696When you configure the RADIUS authentication order with local first and radius second, the RADIUS user is authenticated as a default user name.5.12.1-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.05.9.4
4534357During Cumulus Linux upgrade or downgrade, rsyslog might crash because the management (eth0) port is unavailable, which triggers a use-after-free fault and produces a cl-support file as a response.5.13.1-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4531960The GNMI Subscription to xpath interfaces/interface[name=swp61s0]/state/counters/out-pkts with a high sample interval results in an initial response of zero but in subsequent updates, the value is correct. You do not see this issue when the sample interval is 1 second.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4513849After upgrading from Cumulus Linux 5.12 on the NVIDIA SN5400 switch bonus port, PTP does not converge. To work around this issue, disable, then enable the bonus port after upgrade.5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4509255, 4546858In PTP two-step, the hardware incorrectly modifies the SYNC message correction field.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4508830Cumulus Linux allows you to add bond ports of mismatched speeds (such as 10G and 25G) to the same LACP bond without error and the bond reports UP.5.11.2-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4501632, 4530257NVIDIA recommends you wait for approximately 60 seconds after running nv config apply before power cycling the switch so that NVUE database has time to sync to the filesystem.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4495383, 4493988NVUE configuration yaml file translation converts unset commands to set commands because the translation logic expects only set commands.5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4495231If the hardware clock date is later than 2038-01-19 03:14:07 UTC, the image might fail to install due to a grub-install failure on the EFI filesystem, which is a VFAT filesystem. As a result, you see the grub prompt immediately after reboot. To work around this issue, reboot from the grub prompt to go into ONIE. From ONIE, use the date command to set a date before 2038-01-19, then run the hwclock –systohc command to add it to the hardware clock. You can then use onie-nos-install to install the image.5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4475401External input such as Ctrl+\ might trigger core dumps on the serial console from /bin/login. This behavior is caused by external sources, such as console servers or automation tools, and does not reflect a fault in the operating system. As a potential result, the serial console might become unresponsive.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4475111When you try to convert a layer 3 port that is part of ECMP to a bond member, you might see a failure in the switchd logs. This issue does not have any functional impact.5.11.2-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.05.9.4
4475074The SN5610 switch records a High FEC Bin Error at room temperature.5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.05.11.2
4440766When you try to delete a trusted ca key, Cumulus Linux shows an incorrect error message. To remove a trusted ca key, you must unset the key ID, not the key literal.5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4423368When all links go down or the switch reboots, you see next hop group churn from Zebra to the SOO next hop group. This issue might cause some convergence degradation.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4423360After a remote link flap, neighbor entries using the link might not get resolved immediately. Only when some traffic uses the nexthop will they be resolved.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4423352ZTP scripts return an error due to incorrect ASCI to UTF-8 conversion.5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4423335When you configure TACACS with NVUE or merge an NVUE configuration file that includes TACACS configuration with the nv config patch command, you see an unrecoverable error when running additional NVUE commands. To work around this issue, restart the NVUE service with systemctl restart nvued.service.5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4423269When you configure the switch to move to warm restart mode, the message does not clearly indicate that the reboot to get the switch into warm mode is not hitless.5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4423248If you unset an interface static IP address when the interface IP gateway is configured, the nv config apply command fails with an ifreload.service error. To work around this issue, unset both the static IP address and gateway together.5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4423244When you enable, then disable adaptive routing, the BGP neighbors might go down because of an unresolved MAC address. To work around this issue, configure another attribute on the interface.5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4423235The snmpd service generates debugging logs of sudo calls. To work around this issue, disable sudo logging for the specific commands run by the Debian-snmp user in the /etc/sudoers.d/snmp file by adding Defaults:Debian-snmp !syslog.5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4423175When you configure an API port with a TCP port already in use, the nginx server fails to restart.5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4413589A MAC-only EVPN type-2 route is wrongly advertised with the layer 3 VNI label in the BGP NLRI (Network Layer Reachability Information). Although this does not have any functional impact, it is not the desired RFC behavior.5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4370954After enabling, then disabling truncation on a SPAN session, truncated packets are still received on the SPAN destination. To work around this issue, remove the SPAN session configuration, reboot the switch, then reconfigure the SPAN session without truncation.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4337278Statically configured VXLAN entries sometimes age out after a peer link flap.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4329931Cumulus Linux incorrectly allows SyncE and PPS to be enabled at the same time. Upgrading systems with both features configured using NVUE to 5.12.0 or later results in a failure to apply the startup configuration as part of the first boot of the upgraded version. To work around the issue, unset one of the features before you upgrade.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4309876When you configure an invalid switch port (swp), NVUE adds the invalid configuration instead of rejecting it. The invalid interface in the configuration does not have any functional impact.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4308857When you use tls_crlcheck in the /etc/nslcd.conf file, the optional nslcd service fails due to a missing library.5.9.2-5.9.3, 5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.05.9.4
4294156After you clear the RoCE counters with the nv action clear interface qos roce counters command, the buffer-max-usage counters in the nv show interface qos roce counters command output do not show updated (cleared) values.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4277042On the NVIDIA SN5600 switch, you see low power alarms immediately after a reboot. The alarms disappear after showing up initially. Certain modules typically show low power alarms on initialization. No action is needed.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4249096Binary upgrade from Cumulus Linux 4.3.1 to 5.12.0 and later is not supported. To work around this issue, perform a binary upgrade from Cumulus Linux 4.3.1 to 5.9.0, then perform a binary upgrade from Cumulus Linux 5.9.0 to 5.12.0 or later.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4236419On the Spectrum-3 switch, the PTP offset for 25GbE fluctuates within a range of plus or minus 50 nanoseconds beyond the expected values.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4214678Changes to open telemetry configuration or export states restarts the telemetry service and resets all health metrics.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4177067When performing a package upgrade, nslcd installation might open an interactive dialog to configure nslcd.conf.
To avoid this interactive dialog, set the DEBIAN_FRONTEND environment variable to noninteractive. For example:
cumulus@switch:~$ sudo apt-get update
cumulus@switch:~$ sudo DEBIAN_FRONTEND=noninteractive apt-get -y -o “Dpkg::Options::=–force-confdef” -o “Dpkg::Options::=–force-confold” upgrade
5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4154839, 4280933, 4291934When you run certain SDK commands (such as sudo sx_api_port_counter_dump_all.py or sx_api_fdb_dump) first as the cumulus user, then with sudo, you see the following error:
PermissionError: Errno 13] Permission denied: ‘/tmp/python_err_log.txt’

To resolve this issue, run the rm -rf /tmp/python_err_log.txt command.		5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4142857The switch drops PTP packets received with extra ethernet padding and you see syslog [ptp4l.ERR] messages.5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4139511, 4184813, 4180112When you generate the cl-support file on the Spectrum-4 switch, the following messages appear on the serial console. You can safely ignore this issue.
[ 1903.595131] mlxsw_minimal 2-0048: Could not acquire lock
[ 1903.601089] mlxsw_minimal 2-0048: Reg cmd access failed (reg_id=900a(mtmp),type=query)
[ 1903.609961] hwmon hwmon28: Failed to query module temperature thresholds
[ 1903.846724] mlxsw_minimal 2-0048: Could not acquire lock
[ 1903.852689] mlxsw_minimal 2-0048: Reg cmd access failed (reg_id=900a(mtmp),type=query)
[ 1903.861573] hwmon hwmon28: Failed to query module temperature
5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4134447The journal logs might include the error message ERR kernel: [ 7.453789] usb usb2-port2: connect-debounce failed. You can safely ignore this log message.5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4129757If you include a comma in the BGP community list, extended community list, or large community list regex expression of a routing policy, you see error messages and FRR reload fails. Make sure the regex expression does not contain a comma.
For example, instead of ^65550:([0-9]{1,2}|[1-9][1-9]):.$, specify ^65550:([0-9]|[0-9][0-9]):.$ and instead of ^65550:([0-4]{1,2}|[7-9][8-9]):.$, specify ^65550:([0-4]|[0-4][0-4]|[7-9][8-9]):.$.		5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4124376, 4316163The SN3700C-S, SN5400, and SN5600 secure boot switch running Cumulus Linux 5.11.0 or later boots with shim 15.8 that adds entries to the SBAT revocations to prevent the switch from booting shim 15.7 or earlier (included in Cumulus Linux 5.10 and earlier).
To downgrade a secure boot switch from Cumulus Linux 5.11.0 or later, or to recover a downgraded switch that does not boot, follow the steps in Downgrade a Secure Boot Switch.		5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4118970When running PTP, the performance for 100Gx2 and 400Gx8 can have a high offset in up to 1.5% of the sampling.5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4105127, 4796391Any sFlow configuration changes that require an hsflowd restart are operational only after an initial delay of 60 seconds.5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4100629NVUE show command outputs show LLDP neighbor changes only after the LLDP update frequency multiplied by the hold time.5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4082210When you change the CPU resource limit with the nv set service control rsyslog resource-limit cpu command, the rsyslog agent does not start. To work around this issue, increase the CPU resource limit, then restart the service manually.5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4077921You cannot use package upgrade to upgrade from Cumulus Linux 5.9.2 to Cumulus Linux 5.10.1 or later. You must install the Cumulus Linux image instead.5.10.1-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4049213, 4186873When there are routes that point to a single next hop, an ECMP entry is created in the SDK. After the single next hop from the route is removed, the ECMP entry might stay in the SDK until the time the next hop is present in the kernel.5.9.2-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4047798Packet distribution based on ECMP hashing using GTP-TEID does not function as expected in an EVPN Clos topology.5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4030380When you roll back interface configuration to the default setting with the nv unset interface command, NVUE removes the complete entry for the interface from the /etc/network/interface file, and puts the interface in admin down. As a result, you cannot configure FEC on the interface at the lower layers.5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
4005422, 4015452When you upgrade Cumulus Linux 5.9.1 to Cumulus Linux 5.10 or later with package upgrade, the NTP service stops. To restart the NTP service, enable, then restart the service in the VRF in which it was running with the systemctl enable ntpsec@ and systemctl restart ntpsec@ commands.5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3985682On Spectrum-4 switches, multicast flows containing packets smaller than 512 bytes might not reach full line rate. Cumulus Linux supports 512 byte and larger multicast packets.5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3966312When connecting the SN5xxx switch to third party test equipment (such as IXIA) using copper cables at 100GbE, 200GbE, 400GbE, or 800GbE, links do not come up.5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3948068On the SN3700 and SN3700c switch, the nv show platform environment voltage command output shows a failed state for the PSU-n-12V-RAIL-OUT sensors. This is a known hardware limitation that cannot be corrected by the PSU vendor.5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3915878If you configure remote syslog export through a non-default VRF, you might see repeated error logs from the rsyslog process while the switch is booting:
rsyslogd: create UDP socket bound to device failed: No such device [v8.2302.0]rsyslogd: No UDP socket could successfully be initialized, some functionality may be disabled.  [v8.2302.0]

The logs occur because the rsyslog service starts before the networking service creates the configured VRF for syslog export. There is no functional impact with this issue.		5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3879717Running snmpwalk on the switch with the management IP address does not work. To work around this issue, use the localhost option (snmpwalk -v 2c -c public28 localhost 1.3.6.1.2.1.14) or create a control plane ACL whitelist rule.5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3878394When ZTP runs a script that contains wget, ZTP fails and you see a message similar to the following:
ZTP: ZTP DHCP: Unexpected error: ‘ascii’ codec can’t decode byte 0xe2 in position 181: ordinal not in range(128)ZTP: Script returned failure

To work around this issue, use the -q option with wget.		5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3877516When you connect two NVIDIA switches and configure 400G speed in force mode, links don’t come up.
To work around this issue, make sure auto-negotiation is always on when connecting NVIDIA to NVIDIA in PAM4.		5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3875373When you run the nv config apply empty command, NVUE removes the cumulus user. If you are logged in as the cumulus user when you run the nv config apply empty command, the command fails.5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3861745On UEFI hardware (where the /sys/firmware/efi directory exists), using the update-grub program might generate a /boot/grub/grub.cfg that is incorrect for booting ONIE if the ONIE option is selected on the console while booting. To work around this issue, run mount LABEL=“EFI System” /boot/efi before using update-grub.5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3855796When configuring a Unicast Master Table for clients, the server addresses must be reachable and the route to the destination must exist. The unicast table can have one directly-connected port for a client. This restriction is only for directly connected ports and doesn’t apply to Unicast Servers on other devices or switches.5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3847439In rare cases on the Spectrum 1 switch, where a dual connected host transmits all traffic flows to only one switch in a connected MLAG pair, and the host changes behavior to hash all flows to the other MLAG switch, there might be traffic loss if the MAC FDB entry on the original switch ages out.5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3819945When you connect an NVIDIA SN4410, SN4700, or SN5600 switch to any Spectrum 1, Spectrum-2, or Spectrum-3 peer switch (with four lanes) using a 4x breakout configuration and the default lanes per port setting, links do not come up. To work around this issue, provide the lanes per port configuration shown below:
cumulus@switch:~$ nv set interface  link breakout 4x lanes-per-port 1
5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3818545The terminal monitoring software SecureCRT has a known issue when running on both Windows and Mac systems where it gets stuck when monitoring the serial port of the switch as Cumulus Linux boots up. When this occurs, the serial port stops as shown below and SecureCRT is unable to receive any more serial data from the switch (it is able to transmit).
Mounting dev-hugepages.mount - Huge Pages File System..
Mounting dev-mqueue.mount
5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3774274When you manually configure the /etc/cumulus/datapath/qos/qos_features.conf file without applying the QoS configuration with NVUE, running the nv config apply empty command later does not clean up the QoS configuration. If the QoS configuration includes breakout ports, the nv config apply empty command fails due to a switchd reload trigger failure. To work around this issue, clean up the configuration manually in the /etc/cumulus/datapath/qos/qos_features.conf, then run the nv config apply empty command.5.8.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3773177When you try to upgrade a switch from Cumulus Linux before 5.6.0 with package upgrade, you might see errors for expired GPG keys that prevent you from upgrading. To work around this issue, install the new keys with the following commands, then upgrade the switch.
cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/c/cumulus-archive-keyring/cumulus-archive-keyring_4-cl5.6.0u5_all.deb
cumulus@switch:~$ sudo apt install ./cumulus-archive-keyring_4-cl5.6.0u5_all.deb
cumulus@switch:~$ sudo apt update
cumulus@switch:~$ sudo apt upgrade
4.0.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3771168When you perform an ISSU upgrade on a Spectrum 1 switch, the switchd service might crash.5.8.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3677533Due to resource constraints on the Spectrum 1 switch, staticd performance drops and takes longer to read static routes compared to the time BGP takes to complete a graceful restart and advertise routes and EOR to its helpers. As a result, static routes are advertised after the EOR is sent to graceful restart helpers, which delete the stale static routes and relearn them after receiving the EOR from the restarting node. Temporary traffic loss might occur.5.7.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3655681When you disable, then enable STP auto-edge on a port, the port might not transition to the operational edge even though the port does not receive BPDUs. To work around this issue, configure the port as an admin-edge port.5.7.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3637444Applying an inbound control plane ACL on the eth0 management interface does not take effect. To work around this issue, apply the ACL on the mgmt interface; for example, nv set interface mgmt acl inbound control-plane.5.7.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3591918The nv action disconnect system aaa user command does not clear all open sessions. To work around this issue, run the command as many times as the number of sessions.5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3587393If you use the NVIDIA SN5600 (Spectrum-4) switch with Ixia test equipment, you might experience delayed link up due to intermittent link flaps.
To work around this issue when using copper cables:
  • Use Ixia IxOS version 9.37 with HF002156, or version 9.39 or later.
  • Use the DAC cable on ports 10 through 50.
  • Use NVIDIA cables with the recommended firmware revision.
  • Configure AN on the Cumulus Linux switch and AN/LT on Ixia.

To work around this issue when using fiber cables:
  • Configure 800g/Force.
  • Use the recommended NVIDIA optical adapters.
5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3556762, 3463827On rare occasions, SPT switchover might not happen cleanly in PIM resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout.5.5.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3540510400Gx8 ports only support traffic line rate with packets that are larger than 172 bytes.5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3538321, 3564344In rare cases, an STP topology change on PTP over a VLAN can result in the switch losing the slave state and one of the ports might remain in an uncalibrated state. To work around this issue, toggle the port that is in the uncalibrated state up and down so that one of the ports is selected as the slave.5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3497622When you remove PSUs, then plug them back in, you might experience traffic loss and some ports might be in a down state.5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3472163On a switch with the Spectrum-4 ASIC, packets that are smaller than 256 bytes are not included in multicast flows. Multicast flows support packets that are 256 bytes or larger.5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3444490Migration from ONYX to Cumulus Linux is supported and tested with ONYX version 3.10.4302 GA only.5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3442569, 3520880, 3586421When trying to access the NVUE API, user accounts authenticated with a newly-configured external service, such as TACACS, RADIUS, or LDAP, receive a 401 forbidden error. To work around this issue, after enabling a new authentication service, make sure to restart both nginx.service and nvued.service to begin authenticating users against the new authentication service.5.5.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3430430, 3337848When you configure PTP on 50G ports, the offset correction might be higher, which can affect the time synchronization of the node. To work around this issue, configure PTP on 100G ports, or on 10G or 1G ports with PTP shaper enabled.5.5.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3424967, 3413785sudo for TACACS+ users with privilege level 15 does not work when reaching the TACACS+ server through the default VRF. To work around this issue, specify the interface name that the default VRF uses in the vrf= setting of the /etc/tacplus_servers file or run the NVUE nv set system aaa tacacs vrf command. If you don’t run either command, a TACACS+ user with privilege level 15 can run vrf task exec default sudo … to execute the sudo command.5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3420056The ADVA 5401 SFP module with hardware revision 5.01 does not come up at layer 1 when you use 10G QSA adaptors. To work around this issue, use 25G QSA adaptors.4.4.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3414866, 3536555, 4465009, 4509253, 4732973Each VLAN is represented as a bitmap on the underlying port and when you add multiple VLANs together, Cumulus Linux iterates over the existing ones and updates the diff. However, in few corner cases, the same bitmap might be repeated again causing the following error.
sx_sdk: 22985 [BRIDGE] [ERROR  ]: Port(0x200A000D)) already added to a bridge

You can ignore this error; it has no impact on switch functionality.		5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3362113If you restore an NVUE startup.yaml file or run the nv config patch command after an upgrade that includes breakout ports with QoS configuration, the NVUE configuration fails to apply. Subsequent attempts to run nv config apply fail with a message similar to Invalid config [rev_id: 11] qos config is not supported on the following invalid interface: swp1s0. Supported on swp and bond interface types. To work around this issue, run nv unset on the configured QoS settings, then apply the breakout port configuration before you configure QoS. Alternatively, you can remove the QoS configuration from the yaml file and patch it separately after applying the breakout configuration.5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3347538When connecting NVIDIA-to-NVIDIA in PAM4, you must enable auto-negotiation.5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3341214If you use the NVUE REST API to configure a local user with a hashed password, the user cannot log in and the /etc/nvue.d/startup.yaml file shows the password as plain text.5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3329518When using TACACS+, if the /etc/nsswitch.conf file specifies passwd: files tacplus (files is listed before tacplus), a user that is present in both the local /etc/passwd file and the TACACS+ server cannot log into the switch. NVIDIA recommends that when using TACACS+, you list tacplus before files in /etc/nsswitch.conf. When using NVUE, ensure that tacacs has priority over local.5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3327477If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password.3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3326659If you have a large number of MAC addresses, they do not age out at the MAC ageing timeout value configured on the switch. It might take up to 30 seconds more for the MAC addresses to age out and be deleted from the hardware. To work around this issue, wait for the ageing timeout value plus 30 seconds.5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3253218Auto-negotiation isn’t supported on Spectrum-2 and Spectrum-3 switches using the 1G SFP-T module; FORCE 1G is configured instead.5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3241567When you apply switch configuration for the first time on a freshly booted switch and you run the nv config apply command after setting the hostname with nv set system hostname, you might see the error message Failed to start Hostname Service. To work around this issue, run the nv config apply command a second time.5.3.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3226506The l1-show eth0 command does not show port information and is not supported in this release.5.3.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3225117, 3158720Occasionally, packet loss might occur on 25G ports when the link is raised without FEC.5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3172504When you connect the NVIDIA SN4600C switch to a Spectrum 1 or Spectrum-3 switch with a 40GbE passive copper cable (Part Number: MC2210126-005) on edge ports 1-4 and 61-64, there is an Effective BER of 1E-12 in PHY.5.2.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3147782You cannot use NVUE to configure an SNMP view to include a subtree beginning with a period. For example:
cumulus@switch:~$ nv set service snmp-server viewname cumulusOnly included .1.3.6.1.4.1.40310Error: GET /nvue_v1/service/snmp-server/viewname/cumulusOnly/included?pointers=%5B%22%2Fparameters%22%2C+%22%2Fpatch%2FrequestBody%2Fcontent%2Fapplication~1json%2Fschema%22%2C+%22%2Fpatch%2Fparameters%22%2C+%22%2Fpatch%2Fresponses%2F200%2Flinks%22%5D responded with 404 NOT FOUND
To work around this issue, reference the OID without the preceding period ( . ) in the command.		5.3.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3145869, 3430508, 3543102On a Spectrum-3 switch, the PTP offset in 10GbE changes between plus or minus 27. The average offset is around 7.5.2.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3135952PAM4 split cables (such as 2x100G, 4x100G, and 4x50G) do not work with a forced speed setting (when auto-negotiation is off) as the default speed enabled is for NRZ mode (such as 100G_4X). To work around this issue, set the appropriate lanes for forced speed (with auto-negotation off) with the ethtool -s swpX speed <port_speed> autoneg off lanes <no_of_lanes> command. For example:
cumulus@switch:~$ sudo ethtool -s swp1 speed 100000 autoneg off lanes 2
5.2.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3115242When you configure two VNIs in the same VLAN, ifupdown2 shows a vlan added to two or more VXLANS warning, which is only issued after the VNI is already added to the bridge. This leaves the new VNI in the PVID even if there is already an existing VNI configured in that PVID.5.1.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3103821On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames.5.2.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3084476After you disable traffic shaping in the /etc/cumulus/datapath/qos/qos_features.conf file, the default QOS traffic shaping configuration does not restore. To work around this issue, restart switchd.4.4.3, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.04.4.4-4.4.5
3084027Under a high load, you might see ingress drop counters increase. The drops are classified as HwIfInDiscards in ethtool and shown as ingress_general in hardware.4.3.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3071652On rare occasions, after you reboot or restart switchd on a Spectrum 1 switch, any 25G connections with Direct Attach Copper (DAC) cables that connect from the switch to a non-NVIDIA device might flap continuously. To work around this issue, bring the affected link administratively down for a few seconds on the non-NVIDIA device, then bring the link back up.4.4.4-4.4.5, 5.1.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
3061656When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds.5.1.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
2972540With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts.5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
2951110The net show time ntp servers command does not show any output with the management VRF.3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
2904450, 2553222When you run the ethtool -m or the l1-show command, the 400G interface optical values do not show.4.4.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
2885305, 2887500, 3234087, 3074929, 3293192Certain Murata PSU attributes show intermittently in the sensors command output. To work around this issue, upgrade to the latest PSU firmware on Murata.5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
2867042When connecting the NVIDIA SN4600 switch to another NVIDIA Spectrum switch, you must use auto-negotiation mode (not force mode); otherwise the switch might use the wrong Tx configuration.5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
2823307Cumuls Linux does not support a bond with more than 64 ports. Any configuration with more than 64 ports in a bond changes all ports to down when you apply the configuration.5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
2736108When you change the VRRP advertisement interval on the master, the master advertisement interval field in the show vrrp command output does not show the updated value.4.4.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
2684925The NVUE nv show vrf default router bgp peer command produces a 404 not found error.4.4.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0
2671652In VXLAN routing environments, you might experience sub-optimal route convergence delays (longer than five seconds) when a prefix transitions to a new ECMP next-hop group. This condition might occur when a VTEP loses ECMP routes through all uplink peerings, then installs the routes through a different path, such as an MLAG peerlink.4.4.0-4.4.5, 5.5.0-5.15.1, 5.16.0-5.16.1, 5.16.5-5.17.0

Fixed Issues in 5.17.0

Issue IDDescriptionAffects
5058751The NVUE nv show interface <interface-id qos pfc command does not support interface ranges.5.16.5
5056596The nv show interface qos pfc command takes approximately three minutes to execute.5.16.1
5032841, 4913679On Spectrum-1 switch, creating a bridge interface (SVI) fails with the error message STATUS_NO_RESOURCES.5.16.1, 5.16.5
5032819, 4983144If the nginx nvue.conf file is updated (for example, during package update) and the authenticator service is not running, the startup configuration might fail, which results in the nginx nvue.conf file being taken from the debian package instead of from the nvue configuration you created.5.16.1
5029624The /var/log/event_logger file does not rotate when the file size exceeds 1MB, which might unexpectedly fill the /var partition. To work around this issue, remove the rsyslog configuration file /etc/rsyslog.d/12-event-logger.conf for event-logger and restart the rsyslog daemon with the systemctl restart rsyslog command to restore the default configuration.5.16.1
5023394On Spectrum-1 switches, where the allocated MAC range crosses the hardware MAC profile boundary, the range check incorrectly identifies out-of-range MAC addresses as compatible. This causes the switch to program a router interface with a MAC address that the hardware cannot accept, resulting in interface creation failures with a No More Resources error.5.16.1
5018899RADIUS Access-Request and Accounting-Request packets carry the loopback address 127.0.1.1 in the NAS-IP-Address attribute instead of the management interface address. RADIUS servers that authorize or log requests based on the NAS-IP-Address reject or fail the authentication requests.5.15.0-5.15.1, 5.16.0-5.16.1
5012295Configuring ECMP Hash seed with NVUE does not program the configuration into hardware with a switchd reload.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5
5005096The AI Ethernet statistics metrics collection sometimes times out and does not return any data.5.16.5
4992204Cumulus Linux does not support the NVUE nv set nve vxlan port command; you do not see the configured UDP port in the outer VXLAN packet header.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4989932Cumulus Linux 5.16 released with updated kexec-tools without required patches.5.16.0-5.16.1, 5.16.5
4989386In rare cases, where a gNMI client terminates without cleaning up its gNMI gRPCs, the gNMI server might continue to buffer notifications for the client, resulting in an increase in gNMI server memory usage and potentially leading to a gNMI server restart.5.15.1, 5.16.0-5.16.1
4989352, 4989413GNMI subscriptions might not return interface counter metrics when there is an active, low-rate (1 second) subscription to transceiver data.5.16.0-5.16.1
4988339You see the following Sxd-kernel errors about late completion and new maximum time between iterations detected.
kernel: [875348.575113] sxd_kernel: dev_id=1: Receive late completion for dqn (0) idx (65)
kernel: [899873.236610] sxd_kernel: dev_id=1: Health-Check: New maximum time between iterations detected: 7224 msecs (jiffies_now=4519869758, last_work_launch_jiffies=4519867952, HZ=250)
5.16.1, 5.16.5
4983561When interfaces are constantly flapping and the same BGP neighbor comes up on a different interface, routes might not be reprogrammed in the kernel after the kernel deletes them during interface down events. To work around this issue, restart the FRR service.5.16.1, 5.16.5
4983375Upgrading Cumulus Linux to 5.16.x causes a long boot delay and the nvued service remains in an activating state. To work around this issue, run nvue-git-manual-recovery.sh as a root user during maintenance on each node before upgrade, or on any node that has this issue. When successful, upgrade Cumulus Linux. If the script exits non-zero or reports time exceeded, follow the on-screen steps before continuing the upgrade.5.16.1
4983144, 5032819If the nginx nvue.conf file is updated (for example, with package update) and the NVUE git database is corrupt, the startup configuration might fail and the nvue.conf file might come from the debian package instead of the NVUE configuration that you create. To work around this issue, you can force the nginx nvue.conf file to update by making a basic change to system API, applying the change, then backing it out; for example:
nv set system api compression gzip
nv config apply -y
nv unset system api compression gzip
nv config apply -y
5.16.1
4980055With very large configurations, nv config apply command performance might be slow.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4977145In rare cases, when an 802.1x enabled port is flapped, it can cause 802.1x to lock up. As a result, the show status commands on 802.1x do not work, no new sessions are authorized and there are no re-authorizations. To work around this issue and recover from the blocked state, restart the hostapd.service.5.16.1
4968081During switch boot, a race condition between Docker container restoration and LLDP daemon startup might cause /var/run/lldpd.socket to be created as a directory instead of a socket file. When this occurs, the LLDP daemon is unable to clean up the path and fails to start permanently, requiring a reboot to recover.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4966799If automatic cl-support file generation deactivates due to chain of faults and no auto-generated cl-support file exists yet, the deactivation handler service polls for the ring buffer file and logs the syslog message Ring buffer file not found, waiting… until that file appears. The syslog messages might repeat frequently and can make syslog noisy. In environments where syslog has rate limits, other messages might be harder to see. The repeated messages stop after cl-support file generation reactivates and an auto-generated cl-support file generates successfully.
4964407PXE boot intermittently fails when the host is dual attached to two switches on a bond with LACP bypass enabled and the bridge in PVST mode. This issue occurs in MLAG and non-MLAG scenarios. To work around this issue, either unplug, then replug the ethernet cable or set the STP protocol to RSTP.5.11.4-5.15.1, 5.16.0-5.16.1, 5.16.5
4958266With higher port scale, cl-support timeout can be seen.
4957677If FSM cable information does not finish or does not start within three seconds (due to other, higher priority FSM handling), recovery flow is triggered. In some edge cases, this recovery flow does not clean all necessary parameters.5.16.1, 5.16.5
4957394During snmpwalk, memory is leaked for an object that is served by pass persist. The leaked memory is allocated while the SNMP daemon processes GET or GETNEXT for the requests.5.9.5-5.15.1, 5.16.0-5.16.1, 5.16.5
4951125API calls to NVUE generate a TACACS author request for a local user bypassing the authentication order.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4949347, 4949346When interfaces experience authentication failures and retries due to Radius or host misconfiguration, NVUE commands such as nv show interface dot1x-summary and nv show interface dot1x-ipv6-summary become slow and unresponsive. To work around this issue, ensure the RADIUS server is reachable and correctly configured, and that client credentials and certificates are valid. The slowdown is triggered by repeated authentication failures causing deauthentication and re-authentication cycles. Resolving the underlying authentication failures eliminates the blocking behavior.5.16.1
4944244During warm boot on adaptive routing enabled interfaces, you see momentary traffic disruption.5.16.1
4940786, 4705183Transceiver firmware upgrade fails due to PMAOS register access failures.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4938139On the Spectrum-4 switch, the firmware’s cable information recovery flow (triggered when the cable info FSM does not start or complete within three seconds due to contention with higher-priority FSM handling) does not always clean up all parameters. This results in an invalid I2C gateway unlock that is incorrectly raised as a fatal assert, triggering a Health Check event and causing an unexpected switch reboot.
4937867If FSM cable info does not finish or does not start within three seconds (due to other, higher priority FSM handling), recovery flow is triggered. In some edge cases, this recovery flow does not clean all necessary parameters.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4937657During warm and fast reboots, NVUE intentionally skips a comprehensive Git cleanup to adhere to strict service start-up SLAs. When this cleanup is bypassed, existing Git maintenance debt, such as unreachable loose objects or blocked Garbage Collection (GC) states, remain in place and accumulate across successive reboots. The lightweight housekeeping performed during a standard nv config apply is not equivalent to a full cleanup. Consequently, stale objects and blocked GC states can persist until the repository becomes unreadable, eventually causing git commit operations to fail with the error fatal: could not parse HEAD.
To work around this issue, run sudo systemctl restart nvued.service manually after a warm or fast reboot to trigger the full cleanup path.		5.16.1
4933966When moving from split 4 to split 2 on a port, FIFO corruption occurs, causing packets to become stuck in the egress queue.5.16.0-5.16.1, 5.16.5
4931956Upgrading Cumulus Linux from 5.13.1 or earlier with package upgrade using NVUE commands nv action upgrade system packages sometimes fails or might be interrupted after the packages have been unpacked but not configured. This might cause odd behaviors, such as missing files or symlinks ,or TACACS+ restricted user shells not behaving as expected. If dpkg -l shows packages with a status such as iU instead of ii (first two characters of the line), use sudo dpkg –configure -a to finish configuration of the packages; then retry the package upgrade in case any packages are not downloaded or unpacked.

To avoid this issue, turn off sysmonitor with sudo systemctl stop sysmonitor before doing a package upgrade with NVUE commands.		5.13.1-5.15.1, 5.16.0-5.16.1, 5.16.5
4931702When you launch a Cumulus VX 5.16.1 image in Air with switch emulation, you see the systemd-remount-fs.service systemd service in a failed state. This issue has no functional impact.5.16.1, 5.16.5
4930970Unreachability routes originated locally (for example, due to a link-down event) display incorrect BGP origin attribute values in show commands and JSON output. The origin shows as IGP instead of incomplete and JSON fields include redundant origin symbols in the AS path string.5.16.0-5.16.1, 5.16.5
4930152When you configure layer 3 SVI interfaces with an anycast gateway (VRR) IP address only and no unique IP address, the connected route for the subnet is not programmed in the ASIC, causing packets destined for locally connected hosts to drop after decapsulation.5.11.3-5.15.1, 5.16.0-5.16.1, 5.16.5
4930019The OTEL nvswitch_buffer_cell_size_bytes metric is missing.5.16.1, 5.16.5
4926427, 4926426When you run the nv config apply command or the sudo systemctl reload frr.service command on a switch configured with VRF route leaking that has many BGP peers, VRFs, and BGP learned prefixes, FRR reload might time out. To work around this issue, run sudo systemctl edit frr.service to change the TimeoutSec=2m to a higher value and apply the changes with sudo systemctl daemon-reload.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4925514, 4919006Core processing services such as cumulus-core.service and cumulus-core.path might enter a failed state due to systemd start rate limiting caused by rapid start and stop cycles. This issue can prevent core files from being included in subsequent automatically generated cl-support collections even after you reactivate automatic cl-support generation after deactivation due to a chain of faults. Newly generated core files might accumulate, potentially leading to /var partition exhaustion. To recover from this condition, run the sudo systemctl reset-failed cumulus-core.service cumulus-core.path command.5.16.1, 5.16.5
4925419When you exceed the maximum number of ports allowed (30) in an 802.1x IPv6 profile, IPv6 addresses are not allocated to additional ports even if authentication is successful. To work around this issue, create additional profiles with the same configuration, associating no more than 30 interfaces to each profile.5.16.0
4925316Known registered multicast traffic is duplicated to receivers behind an EVPN-MH dual-homed access switch.5.16.0-5.16.1, 5.16.5
4925207The graceful restart helper node experiences temporary traffic loss when the peer goes under warm boot.5.16.0-5.16.1, 5.16.5
4924838When the a BGP neighbor is up for more than a day (24 hours), the uptime depicts correctly but the reset time which indicates the last connection reset time, does not account for the time elapsed past a day after the BGP neighbor resets. This is a display issue in NVUE; there is no direct traffic or functional impact.5.16.0-5.16.1, 5.16.5
4924486, 4924487A fatal SDK event might occur during i2c or cable read events, observed with the following switchd log message:
hal_mlx_host_ifc.c:3531 CRIT Restarting switchd to recover from fatal SDK health event: FW health issue
5.12.1-5.15.1, 5.16.0-5.16.1, 5.16.5
4923092The firmware includes two asserts assert id = [0xc2e], [0x627] that are incorrectly categorized as fatal. The firmware has reduced the severity of these asserts and they no longer result in health event and switchd crashes.5.16.0
4922188If you add a static default route, then delete it, the switch removes the default route in the ASIC.5.16.0-5.16.1, 5.16.5
4918539When you configure OTEL to generate a large number of metrics with a small sample interval but the remote receiver is unreachable, OTEL collector memory usage might increase rapidly leading to the OTEL collector being Out Of Memory Killed.5.16.0
4918507When you upgrade Cumulus Linux from a prior release with package upgrade, TACACS users with a restricted bash shell might not be able to recall shell commands from history with the up and down arrow keys.5.16.0-5.16.1, 5.16.5
4918342, 4641291In rare circumstances, the switch stops streaming telemetry data for interface counters, buffers, or PHY.5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4917759BGP sessions configured with an explicit IPv6 link local peer address might result in stale or invalid next hop tracking entries after a session disruption.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4916952When core files generate or persist due to repeated faults after tech-support auto-generation deactivates, the switch repeatedly attempts to trigger tech-support collection resulting in continuous error messages.5.16.0
4913308When you upgrade Cumulus Linux from 5.13.1 to 5.16.0, TACACS users with a restricted bash shell might not be able to recall shell commands from history with the up and down arrow keys.5.16.0
4911812Running snmpwalk of entity-mib displays empty values for the entPhysicalName and entPhysicalAlias parameters.5.16.0-5.16.1, 5.16.5
4910990TACACS authentication is not working with flat files. The Cumulus Linux user guide is missing the sudo pam-auth-update –enable tacplus command.5.16.0-5.16.1, 5.16.5
4909312Cumulus Linux 5.14 removed the OTEL metric nvswitch_interface_if_in_octets because it duplicated nvswitch_interface_ether_stats_octets.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4908392In the multicast routing path (ip_mr_output) you might encounter a self-deadlock issue in one CPU that causes the kernel lock up (the switch reboots).5.15.1, 5.16.0-5.16.1, 5.16.5
4907468When you configure more than 256 SRv6 static SIDs, NVUE accepts the configuration without error. However, Cumulus Linux only programs the first 256 entries in hardware and drops traffic matching the remaining entries. Counters for the remaining entries are not available with the nv show router segment-routing srv6 stats sid command.5.16.0-5.16.1, 5.16.5
4905123When a spine undergoes a cold reboot (reboot -f) while BGP Graceful Restart is configured, the leaf (acting as the GR helper) retains stale routes from the spine. When the links on the spine come back up before the restart timer expires but before BGP has converged, the leaf revalidates these stale routes and installs them in the FIB, forwarding traffic to a peer that has no routes programmed in hardware yet. To work around this issue, either disable BGP Graceful Restart helper mode on the leaf so that routes are immediately withdrawn when the spine goes down, or perform a warm reboot on the spine instead of a cold reboot so that forwarding state is preserved and links remain up throughout the restart.5.16.0-5.16.1
4905121When you enable conditional disaggregation and a SAFI_UNREACH NLRI for a prefix is received before the corresponding connected (redistributed) route exists in SAFI_UNICAST on the leaf (for example, before the interface has the /64 address prior to 802.1x authorization), the leaf does not originate the conditionally disaggregated route. After the interface gets the address (after 802.1x succeeds), the disaggregated route still does not originate because the code does not re-evaluate existing UNREACH entries against the newly installed unicast prefix.
To work around this issue, clear the BGP session on the leaf that originates the UNREACH to resend the UNREACH NLRI toward the leaf that has the newly programmed interface address. The leaf runs conditional disaggregation and originates the disaggregated route.		5.16.0
4901549In a highly volatile network, frequent churn of SOO‑tagged routes can generate a large volume of SOO NHG sync messages to Zebra. When Zebra becomes backed up while processing these NHG updates, its memory usage can grow significantly.5.14.0-5.15.1, 5.16.0
4900970In an ECMP scenario, the zebra IP routing manager sends recursive next hop messages to BGP even if the resolution status and valid next hops do not change. As a result, zebra might eventually run out memory and terminate.5.16.0-5.16.1, 5.16.5
4899807For BGP unnumbered, SOO routes in the NVUE BGP SOO table have incomplete peer bitindex mappings.5.16.0-5.16.1, 5.16.5
4895597The firmware includes two asserts assert id = [0xc2e], [0x627] that are incorrectly categorized as fatal. The firmware has reduced the severity of these asserts and they no longer result in health event and switchd crashes.5.15.1, 5.16.0
4895589When you run the nv set vrf default router bgp address-family ipv4-unicast state disabled command, you still see IPv4 exchanged between BGP peers. This is because FRR enables IPv4 by default even when there is no explicit configuration.5.16.0-5.16.1, 5.16.5
4895582Setting the AS path allow-my-asn occurrences when the AS path allow-my-asn origin is already configured on the same BGP neighbor or peer group causes an FRR reload failure. This issue affects all AFI and SAFIs, including IPv4, IPv6, EVPN, IPv4 unreachability, and IPv6 unreachability.5.16.0-5.16.1, 5.16.5
4895525During a long-run repeated execution of ethtool -m , the command occasionally returns RAW hexadecimal EEPROM data instead of decoded transceiver fields.5.16.0-5.16.1, 5.16.5
4895501Adding vlan 1 as a tagged VLAN to a newly created MLAG bond fails if no previous VLANs are configured on the MLAG bond.5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4895490After a sudden power loss or power cycle with the IPv6 profile preserve-on-link-down option enabled, the switch might not create the/etc/frr/frr.conf.d/.conf file.
4895298When you configure BGP dynamic neighbors and default-originate with a route map, the default route stops being advertised to those neighbors after an FRR restart, reboot, or after the BGP session re-establishes (after a link flap or a hard clear on the peer). To work around this issue and to ensure that the default route advertises correctly, remove, then readd the default-originate with the route map command or toggle default-route-origination off, then on.5.11.5-5.15.1, 5.16.0-5.16.1, 5.16.5
4895247PTM does not refresh certain entries and the PTM’s neighbor status command (ptmctl -d) continues to show a neighbor that is already gone. This condition clears when the expected neighbor gets discovered.5.15.1, 5.16.0-5.16.1, 5.16.5
4894676The OTEL metrics nvswitch_platform_transceiver_channel_tx_bias_current_threshold_info, nvswitch_platform_transceiver_power_threshold_info, and nvswitch_platform_transceiver_power_threshold_info_mw have the values for labels threshold and level interchanged.
4893569NVUE allows invalid interfaces with leading zeroes; for example, swp000001.5.16.0-5.16.1, 5.16.5
4891771The nv show interface qos-roce-status command causes HIGH CPU.5.16.0-5.16.1
4889939In an MLAG configuration, when the MLAG node receives MLAG peer keepalives from an IP address that is not configured as the peer IP address, a peer IP address mismatch conflict occurs. Even after the conflict is resolved, you sometimes see that the MLAG session still retains the peer IP mismatch conflict.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4885553If ZTP uses a proxy server for image download using onie-install, the image install fails with signing issues.5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4885474, 4891596During warm boot, a transient error ERR Failed to enable ipv4-mc for VRF tbl-id:0 vr-id:1 appears in the switchd log. You can ignore this error; VRF configuration is not affected.5.16.0-5.16.1, 5.16.5
4883698Removing or replacing private ASNs or replacing private ASNs with public ASNs under the ipv4-unreachability or ipv6-unreachability address family on a BGP neighbor or peer group causes FRR reload to fail. FRR does not support these options for the unreachability address families.5.16.0-5.16.1, 5.16.5
4883569Removing or replacing private ASNs or replacing private ASNs with public ASNs under the ipv4-unreachability or ipv6-unreachability address family on a BGP neighbor or peer group causes FRR reload to fail. FRR does not support these options for the unreachability address families.5.16.0-5.16.1, 5.16.5
4882392If you run the nv show evpn access-vlan-info vlan command after deleting a bond interface, which is part of a bridge, the server encounters an internal error.5.9.1-5.15.1, 5.16.0-5.16.1, 5.16.5
4881914Removing or replacing private ASNs or replacing private ASNs with public ASNs under the ipv4-unreachability or ipv6-unreachability address family on a BGP neighbor or peer group causes FRR reload to fail. FRR does not support these options for the unreachability address families.5.16.0-5.16.1, 5.16.5
4881679When the system is under load and the wd_keepalive process is running at the default rate of one time per minute, the switch might reboot due to starvation of the wd_keepalive process.5.13.1-5.15.1, 5.16.0
4879165When you configure dynamic NAT and traffic enters the switch on a bridge port that is routed through a VLAN SVI (the standard MLAG bridge topology), NAT flows are not offloaded to the ASIC. An upstream kernel change clears an internal flag during the bridge-to-host handoff that the NAT offload path depends on to signal the hardware. As a result, all dynamic NAT flows fall back to software forwarding on the CPU, reducing throughput by over 99%. Static NAT and deployments using direct layer 3 ports (no bridge) are not affected.5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4875842Noisy logs can appear on the console when there is a pending FRR telemetry configuration and you collect a cl-support file manually.5.16.0-5.16.1, 5.16.5
4875640A rare timing scenario results in the following error log in switchd:
ERR bulk_counter_transaction_set DISABLE failed: Driver’s Return Status is Non-Zero
5.16.0-5.16.1
4875599When you configure authentication for a BGP dynamic neighbor, removing the configuration does not bring back the sessions.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4875122The JSON output for the vtysh show bgp unreachability> summary reports peers as Established even when the AFI or SAFI is not negotiated, while the plain summary shows NoNeg. This causes JSON to misrepresent the per‑AFI or SAFI state for established sessions.5.16.0
4873853TACACS authentication is not working with flat files. The Cumulus Linux user guide is missing the sudo pam-auth-update –enable tacplus command.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4872684Cumulus Linux does not provide protection or a warning when you configure a destructive resource limit for a critical service. A low value resource limit for nvued might terminate the nvued service and block users from using NVUE commands.5.16.0-5.16.1, 5.16.5
4870212When a BGP peer initially advertises UNREACH routes with a matching SoO (Site of Origin), the receiving router correctly triggers conditional disaggregation. However, if the peer later removes the advertise-origin configuration with the nv unset vrf default router bgp address-family ipv6-unreachability advertise-origin command, the receiving router continues to advertise disaggregated routes even though the UNREACH updates no longer contain a matching SoO. This issue results in unnecessary route advertisements where only the aggregate should be advertised.5.16.0-5.16.1, 5.16.5
4870105When you provide a JSON string with double quotes in an NVUE nv set command, the command fails.5.16.0-5.16.1, 5.16.5
4869499When you configure PTP on a trunk interface, where the selected PTP VLAN is the PVID (untagged native VLAN), the PTP packets might be tagged incorrectly with the VLAN ID.5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.5
4867633If a switch reboots in the middle of a git operation, a git lock might be left. After rebooting, that git lock is stale and can prevent other git operations from running, preventing nvued from starting.5.16.0
4863582When cl-support files generate in quick succession due to a chain of faults, the cl-support files are not generated correctly.5.16.0
4862680The vtysh show bgp ipv4 unreachability json and show bgp ipv6 unreachability json commands do not display BGP community attributes (including graceful-shutdown) in the JSON output even though they are shown correctly in the non-JSON text output.
Network automation tools and scripts relying on JSON output might not detect the graceful-shutdown community on unreachability routes, making it difficult to identify routes that are withdrawn due to graceful shutdown procedures.		5.16.0
4861733The NVUE nv set switch host interface command shows forwarding configuration for eth0 and the loopback interface.5.16.0-5.16.1, 5.16.5
4856402The graceful restart helper node experiences temporary traffic loss when the peer goes under warm boot.5.16.0
4855164When you run mlxcmd with non root privileges, you see a python traceback instead of an error message.5.16.0-5.16.1, 5.16.5
4850780After you remove 802.1X IPv6 profile configuration for dynamic IPv6 multi-tenancy, IPv6 addresses and summary routes remain in FRR.
To recover from this state, manually delete the residual files or reauthenticate through the IPV6 profile with hostapd on the affected interfaces.
To avoid this issue, detach the IPv6 profile from the interfaces and apply the configuration, then remove the global 802.1X configuration.		5.16.0-5.16.1, 5.16.5
4850539When you update the SOO NHG, FRR sends redundant route updates to the kernel for every route that uses SOO.5.16.0-5.16.1, 5.16.5
4840271When you configure a static SRv6 Static SID, NVUE does not enable SRv6 automatically and requires you to run the nv set router segment-routing srv6 state enabled command manually.5.16.0-5.16.1, 5.16.5
4830228, 4799012When you configure RoCE lossless priority groups and you use ISSU to perform a hitless upgrade, switchd restarts and ISSU fails.5.15.1, 5.16.0-5.16.1, 5.16.5
4824902, 4944347NVUE no longer supports the nv set system docker state and nv show system docker state commands. Docker remains enabled because core services such as UMF, gNMI and WJH run in containers.5.16.0-5.16.1, 5.16.5
4824056Adding a bond member fails when the member port has subinterfaces and you unset the subinterface and add the bond member under same commit.5.16.0-5.16.1, 5.16.5
4820187, 4895566The firmware includes two asserts assert id = [0xc2e], [0x627] that are categorized incorrectly as fatal. The firmware has reduced the severity of these asserts and they no longer result in health event and switchd crashes.5.16.0-5.16.1, 5.16.5
4731091, 4857885During optimized image upgrade, the switch logs an error because a new file is added. There is no functional impact.5.11.4-5.15.1, 5.16.0-5.16.1, 5.16.5
4722589, 4866475In a large scale configuration, a full MIB walk times out.5.15.1, 5.16.0-5.16.1, 5.16.5

    Copyright © 2026  NVIDIA Corporation