Cumulus Linux 5.8 Release Notes
Download all 5.8 release notes as .xls5.8.0 Release Notes
Open Issues in 5.8.0
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3800536 | Some third-party modules cause false-alarm interrupts during SERDES tuning, which overloads the ASIC and causes an ASIC response delay. | 5.8.0 | |
| 3782543 | When you configure the BGP setting bgp max-med on-startup with vtysh, the MED on some peers might not be set to 4294967294 as expected on startup. The max-med might also fail to reset after the startup timer expires. | 5.6.0-5.8.0 | |
| 3775648 | Enabling or disabling link utilization causes the switchd service to restart, which causes all network ports to reset, interrupts network services, and resets the switch hardware configuration. | 5.8.0 | |
| 3775534 | When you use the NVUE command to configure a static route with distance, the configuration renders incorrectly in the /etc/frr/frr.conf file and the configuration fails. | 5.8.0 | |
| 3773177 | When you try to upgrade a switch from Cumulus Linux 5.5 or earlier to 5.8.0 with package upgrade, you see errors for expired GPG keys that prevent you from upgrading. To work around this issue, install the new keys with the following commands, then upgrade the switch.cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/c/cumulus-archive-keyring/cumulus-archive-keyring_4-cl5.6.0u5_all.deb | 4.0.0-4.4.5, 5.0.0-5.8.0 | |
| 3771168 | When you perform an ISSU upgrade on a Spectrum 1 switch, the switchd service might crash. | 5.8.0 | |
| 3770993 | When a supplicant is authorized successfully on an interface in 802.1x multi-host mode, ping traffic coming into the 802.1x interface towards a local SVI might not be successful. | 5.8.0 | |
| 3770865 | On the NVIDIA SN5600 switch, performing a fresh image install or a power cycle can cause the PCIE link speed to get downgraded from Gen3(8GTs) to Gen1(2.5GTs). To recover, reboot the switch. | 5.8.0 | |
| 3744830 | When configured with NVUE, the Radius secret key can be a maximum of 19 characters long. | 5.7.0-5.8.0 | |
| 3739159 | Disabling adaptive routing globally or on interfaces and performing ISSU, has a significant traffic outage. The issue recovers after ISSU completes. | 5.7.0-5.8.0 | |
| 3739008 | The Lenovo MSN4600-VS2RC (PN SSG7B27990 Back-to-Front/C2P Airflow) might run the fan tray fans at a high speed because the software believes the PSU fans are running in the wrong direction. | 5.5.1-5.8.0 | |
| 3730904 | When sending untagged frames to the CPU with an MTU higher than the SVD (single VXLAN device) MTU, the kernel might crash. | 5.4.0-5.8.0 | |
| 3702431 | Traditional SNMP snippets do not take effect unless you first enable SNMP with the NVUE nv set service snmp-server enable on and nv set service snmp-server listening-address commands. Alternatively, you can use the equivalent REST API methods. | 5.4.0-5.8.0 | |
| 3685007 | Cumulus Linux does not support 802.1X dynamic VLANs on PEAP with MS Windows-based supplicants. | 5.7.0-5.8.0 | |
| 3679478 | Both the ASIC Monitoring service and the What Just Happened (WJH) service try to initialize the SDK TELE module; however, initialization is successful only for the first service to initialize the module. There is no functional impact if a service tries to initialize the module again. | 5.7.0-5.8.0 | |
| 3677821 | If you bring down an interface with Linux or NVUE commands, all the static neighbor entries disappear for that interface. | 5.7.0-5.8.0 | |
| 3677533 | Due to resource constraints on the Spectrum 1 switch, staticd performance drops and takes longer to read static routes compared to the time BGP takes to complete a graceful restart, and advertise routes and EOR to its helpers. As a result, static routes are advertised after the EOR is sent to graceful restart helpers, which delete the stale static routes and relearn them after receiving the EOR from the restarting node. Temporary traffic loss might occur. | 5.7.0-5.8.0 | |
| 3677429 | When there is a flood of ARP packets, switchd might get overwhelmed and go into a busy state. Any NVUE configuration commands for switchd might time out and you might see WARN MAC table full, skipped processing #x learn records log messages in the switchd.log file. To work around this issue, wait for switchd to resolve the ARP floods, which might take a few minutes depending on the amount of ARP flooding (typically between three and five minutes), then reapply the NVUE configuration. | 5.7.0-5.8.0 | |
| 3672706 | When you enable port security, you can configure a maximum of 450 port security static MAC addresses for an interface. | 5.7.0-5.8.0 | |
| 3637444 | Applying an inbound control plane ACL on the eth0 management interface does not take effect. To work around this issue, apply the ACL on the mgmt interface; for example, nv set interface mgmt acl . | 5.7.0-5.8.0 | |
| 3636266 | When an unresolved next hop is present in a next hop group, especially over an SVI interface, the switch checks if the neighbor MAC address is in the forwarding table. If the neighbor’s MAC address not there, the switch skips this next hop from backend programming and you see the switchd error ERR NH: l3 nhg v6 l3 nhg contains one or more unresolvable nexthops. There is no impact to switch functionality as unresolved neighbors are not programmed in hardware until they are resolved. | 5.7.0-5.8.0 | |
| 3634428 | The NUVE nv config history command does not display the correct TACACS user. | 5.7.0-5.8.0 | |
| 3610967 | In an EVPN symmetric routing configuration, running the NVUE nv set vrf command to derive layer 3 VNIs automatically might result in duplicate VLAN entries in the system. This most often occurs at scale when many VRFs have similar names. To work around this issue, manually specify a unique VLAN for each VRF. | 5.3.0-5.8.0 | |
| 3587393 | If you use the NVIDIA SN5600 (Spectrum-4) switch with Ixia test equipment, you might experience delayed link up due to intermittent link flaps. To work around this issue when using copper cables:
To work around this issue when using fiber cables:
| 5.6.0-5.8.0 | |
| 3576949 | When you run the NVUE nv set service snmp listening-address localhost vrf or nv set service snmp listening-address localhost-v6 vrf command to configure the SNMP listening address, Cumulus Linux applies the listening address to the default VRF instead of the VRF you specify. | 5.3.0-5.8.0 | |
| 3556762 | On rare occasions, SPT switchover might not happen cleanly in PIM resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout. | 5.5.0-5.8.0 | |
| 3549798 | If you add a VRF, then SSH into that VRF, which is a generated service (for example, sshd@vrfname.service), the service fails as the VRF is not created in time. To work around this issue, configure the VRF first, apply the configuration, then enable the SSH service on the VRF. | 5.6.0-5.8.0 | |
| 3538321 | In rare cases, an STP topology change on PTP over a VLAN can result in the switch losing the slave state and one of the ports might remain in an uncalibrated state. To work around this issue, toggle the port that is in the uncalibrated state up and down so that one of the ports is selected as the slave. | 5.6.0-5.8.0 | |
| 3484058 | When you power on the NVIDIA SN3420 switch with no connected cables, the QSFP ports LEDs light in amber. | 5.3.0-5.8.0 | |
| 3463827 | On rare occasions, SPT switchover might not happen cleanly in PIM, resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout. | 5.6.0-5.8.0 | |
| 3452681 | When you run the NVUE nv show system aaa tacacs authorization commands to show per command authorization for a specific TACACS+ user privilege level, you see an error message similar to Error: GET /nvue_v1/system/aaa/tacacs/authorization/1?rev=operational responded with 404 NOT FOUND. | 5.5.0-5.8.0 | |
| 3433577 | When you use a single VXLAN device (SVD) with MLAG and static VXLAN tunnels, Cumulus Linux incorrectly associates the MAC addresses it learns from the VXLAN fabric to the bridge PVID. This issue can lead to a feedback loop between the clagd service and switchd, and might result in critical CPU usage with an out of memory condition. Do not use an SVD when enabling MLAG in a static VXLAN environment. | 5.5.0-5.8.0 | |
| 3424967 | sudo for TACACS+ users with privilege level 15 does not work when reaching the TACACS+ server through the default VRF. To work around this issue, specify the interface name that the default VRF uses in the vrf= setting of the /etc/tacplus_servers file or run the NVUE nv set system aaa tacacs vrf command. If you don’t run either command, a TACACS+ user with privilege level 15 can run vrf task exec default sudo … to execute the sudo command. | 5.0.0-5.8.0 | |
| 3420056 | The ADVA 5401 SFP module with hardware revision 5.01 does not come up at layer 1 when you use 10G QSA adaptors. To work around this issue, use 25G QSA adaptors. | 4.4.0-4.4.5, 5.0.0-5.8.0 | |
| 3393966 | Configuring the network statement with the NVUE nv set vrf command might bring down all the OSPF neighbors. To work around this issue, create an NVUE snippet to configure the network statement. | 5.5.0-5.8.0 | |
| 3368217 None | When daylight saving time changes, the MLAG initDelay timer resets and all MLAG bonds go down. | 4.4.4-4.4.5, 5.2.1-5.8.0 | |
| 3362113 | If you restore an NVUE startup.yaml file or run the nv config patch command after an upgrade that includes breakout ports with QoS configuration, the NVUE configuration fails to apply. Subsequent attempts to run nv config apply fail with a message similar to Invalid config [rev_id: 11] qos config is not supported on the following invalid interface: swp1s0. Supported on swp and bond interface types. To work around this issue, run nv unset on the configured QoS settings, then apply the breakout port configuration before you configure QoS. Alternatively, you can remove the QoS configuration from the yaml file and patch it separately after applying the breakout configuration. | 5.4.0-5.8.0 | |
| 3350027 | If you uninstall dynamic NAT rules and switchd restarts before all the dynamic NAT flows age out and are deleted, you might see dynamic flow deletion errors in switchd.log. These errors do not affect new dynamic NAT flows from new NAT rules. | 5.4.0-5.8.0 | |
| 3347538 | When connecting NVIDIA-to-NVIDIA in PAM4, you must enable auto-negotiation. | 5.4.0-5.8.0 | |
| 3345054 | The NVUE nv show interface command takes a significant time to show output or times out. To work around this issue, use specific QoS commands. For example, to show congestion control information, run the nv show interface command. | 5.4.0-5.8.0 | |
| 3341214 | If you use the NVUE REST API to configure a local user with a hashed password, the user cannot log in and the /etc/nvue.d/startup.yaml file shows the password as plain text. | 5.4.0-5.8.0 | |
| 3329518 | When using TACACS+, if the /etc/nsswitch.conf file specifies passwd: files tacplus (files is listed before tacplus), a user that is present in both the local /etc/passwd file and the TACACS+ server cannot log into the switch. NVIDIA recommends that when using TACACS+, you list tacplus before files in /etc/nsswitch.conf. When using NVUE, ensure that tacacs has priority over local. | 5.4.0-5.8.0 | |
| 3327477 | If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. | 3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.8.0 | |
| 3326659 | If you have a large number of MAC addresses, they do not age out at the MAC ageing timeout value configured on the switch. It might take up to 30 seconds more for the MAC addresses to age out and be deleted from the hardware. To work around this issue, wait for the ageing timeout value plus 30 seconds. | 5.4.0-5.8.0 | |
| 3241567 | When you apply switch configuration for the first time on a freshly booted switch and you run the nv config apply command after setting the hostname with nv set system hostname, you might see the error message Failed to start Hostname Service. To work around this issue, run the nv config apply command a second time. | 5.3.0-5.8.0 | |
| 3226506 | The l1-show eth0 command does not show port information and is not supported in this release. | 5.3.0-5.8.0 | |
| 3172504 | When you connect the NVIDIA SN4600C switch to a Spectrum 1 or Spectrum-3 switch with a 40GbE passive copper cable (Part Number: MC2210126-005) on edge ports 1-4 and 61-64, there is an Effective BER of 1E-12 in PHY. | 5.2.0-5.8.0 | |
| 3147782 | You cannot use NVUE to configure an SNMP view to include a subtree beginning with a period. For example:cumulus@switch:~$ nv set service snmp-server viewname cumulusOnly included .1.3.6.1.4.1.40310Error: GET /nvue_v1/service/snmp-server/viewname/cumulusOnly/included?pointers=%5B%22%2Fparameters%22%2C+%22%2Fpatch%2FrequestBody%2Fcontent%2Fapplication~1json%2Fschema%22%2C+%22%2Fpatch%2Fparameters%22%2C+%22%2Fpatch%2Fresponses%2F200%2Flinks%22%5D responded with 404 NOT FOUNDTo work around this issue, reference the OID without the preceding period ( . ) in the command. | 5.3.0-5.8.0 | |
| 3145869 | On a Spectrum-3 switch, the PTP offset in 10GbE changes between +-27. The average offset is around 7. | 5.2.0-5.8.0 | |
| 3135952 | PAM4 split cables (such as 2x100G, 4x100G, and 4x50G) do not work with a forced speed setting (when auto-negotiation is off) as the default speed enabled is for NRZ mode (such as 100G_4X). To work around this issue, set the appropriate lanes for forced speed (with auto-negotation off) with the ethtool -s swpX speed <port_speed> autoneg off lanes <no_of_lanes> command. For example:cumulus@switch:~$ sudo ethtool -s swp1 speed 100000 autoneg off lanes 2 | 5.2.0-5.8.0 | |
| 3122301 | On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. | 5.2.0-5.8.0 | |
| 3115242 | When you configure two VNIs in the same VLAN, ifupdown2 shows a vlan added to two or more VXLANS warning, which is only issued after the VNI is already added to the bridge. This leaves the new VNI in the PVID even if there is already an existing VNI configured in that PVID. | 5.1.0-5.8.0 | |
| 3103821 | On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. | 5.2.0-5.8.0 | |
| 3084476 | After you disable traffic shaping in the /etc/cumulus/datapath/qos/qos_features.conf file, the default QOS traffic shaping configuration does not restore. To work around this issue, restart switchd. | 4.4.3, 5.0.0-5.8.0 | 4.4.4-4.4.5 |
| 3084027 | Under a high load, you might see ingress drop counters increase. The drops are classified as HwIfInDiscards in ethtool and shown as ingress_general in hardware. | 4.3.0-4.4.5, 5.0.0-5.8.0 | |
| 3071652 | On rare occasions, after you reboot or restart switchd on a Spectrum 1 switch, any 25G connections with Direct Attach Copper (DAC) cables that connect from the switch to a non-NVIDIA device might flap continuously. To work around this issue, bring the affected link administratively down for a few seconds on the non-NVIDIA device, then bring the link back up. | 4.4.4-4.4.5, 5.1.0-5.8.0 | |
| 3061656 | When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. | 5.1.0-5.8.0 | |
| 3053094 | When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. | 5.1.0-5.8.0 | |
| 2972540 | With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts. | 5.0.0-5.8.0 | |
| 2964279 | When a VNI flaps, an incorrect list of layer 2 VNIs are associated with a layer 3 VNI. The NCLU net show evpn vni detail command output shows duplicate layer 2 VNIs under a layer 3 VNI. | 3.7.15, 4.4.2-4.4.5, 5.0.0-5.8.0 | 3.7.16 |
| 2951110 | The net show time ntp servers command does not show any output with the management VRF. | 3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.8.0 | |
| 2904450 | When you run the ethtool -m or the l1-show command, the 400G interface optical values do not show. | 4.4.0-4.4.5, 5.0.0-5.8.0 | |
| 2891255 | CVE-2021-39925: Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file. Vulnerable: <= 2.6.20-0+deb10u1 Fixed: 2.6.20-0+deb10u2 | 4.0.0-4.4.1, 5.0.0-5.8.0 | 4.4.2-4.4.5 |
| 2890681 | CVE-2021-42771: relative path traversal in Babel, a set of tools for internationalising Python applications, could result in the execution of arbitrary code Vulnerable: 2.6.0+dfsg.1-1Fixed: 2.6.0+dfsg.1-1+deb10u1 | 4.0.0-4.4.1, 5.0.0-5.8.0 | 4.4.2-4.4.5 |
| 2867042 | When connecting the NVIDIA SN4600 switch to another NVIDIA Spectrum switch, you must use auto-negotiation mode (not force mode); otherwise the switch might use the wrong Tx configuration. | 5.0.0-5.8.0 | |
| 2847755 | When you use NCLU to remove the configuration for a peer that is a member of a group but also has other peer-specific configuration, you must remove the peer-specific configuration before you delete the peer in a separate NCLU commit. | 5.0.0-5.8.0 | |
| 2823307 | Cumuls Linux does not support a bond with more than 64 ports. Any configuration with more than 64 ports in a bond changes all ports to down when you apply the configuration. | 5.0.0-5.8.0 | |
| 2736108 | When you change the VRRP advertisement interval on the master, the master advertisement interval field in the show vrrp command output does not show the updated value. | 4.4.0-4.4.5, 5.0.0-5.8.0 | |
| 2705056 | When configured with NVUE, SVIs do not inherit the pinned MAC address of the bridge. | 4.3.0, 5.0.0-5.8.0 | 4.3.1-4.4.5 |
| 2684925 | The NVUE nv show vrf default router bgp peer command produces a 404 not found error. | 4.4.0-4.4.5, 5.0.0-5.8.0 | |
| 2671652 | In VXLAN routing environments, you might experience sub-optimal route convergence delays (longer than five seconds) when a prefix transitions to a new ECMP next-hop group. This condition might occur when a VTEP loses ECMP routes through all uplink peerings, then installs the routes through a different path, such as an MLAG peerlink. | 4.4.0-4.4.5, 5.5.0-5.8.0 | |
| 2543915 CM-26301 | When you enable a service in the management VRF, systemctl issues a warning similar to the following:Warning: The unit file, source configuration file or drop-ins of ntp@mgmt.service changed on disk. Run ‘systemctl daemon-reload’ to reload unitYou can safely ignore this warning. | 4.0.0-4.4.5, 5.0.0-5.8.0 |
Fixed Issues in 5.8.0
| Issue ID | Description | Affects |
|---|---|---|
| 3766994 | Cumulus Linux 5.6 and 5.7 do not include FRR log rotation, which can result in a very large log file that affects disk usage. To work around this issue, run the following commands as the cumulus user on the Cumulus Linux 5.6 or 5.7 switch. The commands do not impact any other system function.cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/f/frr-logrotate/frr-logrotate_8.4.3-0+cl5.7.0u1_amd64.deb | 5.6.0-5.7.0 |
| 3751952 | ifupdown2 tries to set the multicast database hash elasticity (bridge-hashel attribute) with a value of 4096. However, this attribute is now deprecated in the Linux kernel and the value is always 16. | 5.5.1-5.7.0 |
| 3738626 | If you configure a VNI before an SVI, you can’t add or remove the VRR address from the SVI. To work around this issue, configure the SVI before the VNI. | 5.6.0-5.7.0 |
| 3718614 | When a corrupt or invalid ZTP script exists on the ZTP file server, the ZTP service on the switch might crash and report Too many open files after approximately 1000 download attempts. To recover and restart ZTP, reboot the switch. Always provide a valid ZTP script when using ZTP download. | 5.7.0 |
| 3713420 | When you run the systemctl restart switchd.service command or reboot the switch after you set the host route preference option with the NVUE nv set system forwarding host-route-preference command or manually in the /etc/cumulus/switchd.conf file, switchd crashes and creates core files. | 5.7.0 |
| 3713419 | When monitoring system statistics and network traffic with sFlow, an aggressive link flap might produce a memory leak in the sFlow service hsflowd. | 5.1.0-5.7.0 |
| 3712877 | Configuring the number of lanes per port after breaking out the port is not effective. To work around this issue, first unset the breakout with the nv unset interface and nv config apply commands, then reconfigure the breakout and the lanes with the nv set interface command. For example:cumulus@switch:~$ nv unset interface swp1 link breakoutcumulus@switch:~$ nv config applycumulus@switch:~$ nv set interface swp1 link breakout 2x lanes-per-port 2cumulus@switch:~$ nv config apply | |
| 3712007 | In RSTP mode when there is a bridge port flap, Cumulus Linux flushes, then re-adds dynamic MAC addresses on the peer link, which might cause short traffic disruption. | 5.6.0-5.7.0 |
| 3711830 | NVUE does not let you configure IPv4 ACL rules with the SNAT action on egress layer 3 bond interfaces. To work around this issue, configure the rules in a separate .rules file in /etc/cumulus/acl/policy,d/ directory. | |
| 3710396 | In an eBGP multihop configuration with dynamic neighbors, Cumulus Linux does not update the configured TTL but uses the MAXTTL instead. This issue is only observed with dynamic peers. | 5.6.0-5.7.0 |
| 3698680 | If you run the ifreload -a command when ACLs exist but nonatomic update mode is set in the switchd.conf file, traffic pauses on unaffected interfaces. | 5.6.0-5.7.0 |
| 3695491 | When you log into a Cumulus Linux switch after a fresh install through the serial console, the management VRF might not be available. (This is not an issue with ssh.) To work around this issue, log out, then log back into the console a few seconds later, after the switch finishes booting. | 5.7.0 |
| 3686389 | When you use NVUE commands to configure an untagged VLAN (PVID) on a bridge to a non-default value, nv show bridge commands still indicate that the untagged VLAN is 1 (the default value). The untagged VLAN you configured is properly set on bridge ports, but displays incorrectly in operational NVUE show commands. | 5.6.0-5.7.0 |
| 3671288 | On rare occasions, when the BGP service receives multiple update messages due to multiple route churns in the network, the next hop might become unreachable during the time that the switch processes BGP updates and withdraws with EVPN prefixes. As a result, the EVPN neighbor might be missed in the kernel. | 5.6.0-5.7.0 |
| 3632843 | When the switch receives a type-5 route in BGP and there is a network statement for the same prefix, BGP sometimes removes the request to track next hops from FRR. As next hop reachability changes, BGP no longer reacts to the change. To work around this issue, run the clear bgp * command for all peerings. | 5.6.0-5.7.0 |
| 3630492 | On the NVIDIA SN2201 switch, the ledmgrd -d command output shows the system and PSU LED status as orange when the physical LED is green. | 5.5.1-5.7.0 |
| 3614286 | To avoid unnecessary traffic loss, ifreload (ifupdown2) only flaps a bond to reset its MAC address when the bond MAC address is not present on any of the bond’s interfaces. Previously, ifupdown2 enforced the bond MAC address to be set to the MAC address of the first interface. | 5.6.0-5.7.0 |
| 3334275 | When you run the sensors command, the output shows an erroneous fault on some front panel ports. | 5.2.0-5.7.0 |