CVE-2026-109364

Executive Summary

CVE-2026-109364 is a protection mechanism failure in the routing software suite Zebra (FRRouting lineage) affecting versions 2.3.0 before 6.4.0. The routing daemon keys its ban list and misbehavior scoring on exact IP addresses, which allows an unauthenticated remote peer to evade enforcement and retain routing adjacency. Successful evasion permits a previously banned or misbehaving peer to continue advertising routes, creating an integrity impact (CVSS 5.3) at the control-plane level.

Technical Analysis

The vulnerability is classified as CWE-693 (Protection Mechanism Failure). The NVD description states that "bans and misbehavior scores are keyed on exact IP addresses." In routing protocol contexts such as BGP, the daemon authenticates and tracks peers by peer identifier and address. When a peer misbehaves — for instance, by exceeding configured prefix limits, flapping excessively, or violating Maximum Prefix settings — Zebra assigns a misbehavior score and, upon threshold breach, installs a ban entry. The ban and score tracking data structures are keyed solely on the dotted-decimal IPv4 address or canonical IPv6 address string.

This design creates two independent evasion primitives, both explicitly identified in the advisory:

1. IPv6 /64 re-addressing: In IPv6 deployments, a network peer typically holds a /64 allocation. Because the ban key is the full 128-bit exact address, the attacker can simply source a new connection from a different address within the same /64 subnet. The daemon treats this as a completely distinct peer, with a fresh (zero) misbehavior score and no ban record. This permits an attacker to re-establish a session from a "fresh" address in the same allocation while their prior identity remains banned.

2. FIFO list flushing: The ban structure is described as a 20,000-entry FIFO (first-in, first-out) list. This implies that the ban record store is a bounded ordered list rather than an unbounded indexed set. An attacker who can induce enough misbehavior events across a sufficient number of distinct identities — or repeatedly over time — can push 20,000 entries through the list, evicting older ban records. Once a record is evicted, the original misbehaving peer's exact address is no longer present in the ban table, and the daemon restores the attacker's access on the next reconnection. The FIFO eviction means the oldest bans are the first lost, so an attacker who is patient can cycle a previously banned address back into service with zero changes to network posture.

The root cause is an identity-binding failure: the daemon's policy layer treats a logical or organization-level misbehaving actor (an AS, a routing neighbor, a subnet) as an exact-address keyed record. There is no normalisation to a prefix (e.g. /64 for IPv6) and no persistent identity primitive (peer ID, route target, or cryptographic channel binding). CVSS 3.1 scores this AV:N (network reachable), AC:L (no special conditions), PR:N (unauthenticated), UI:N (no user involvement), S:U, C:N, I:L (the attacker can alter control-plane state — i.e. routes/adjacencies — but not data confidentiality), A:N.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-109364; the attack chain below is inferred strictly from the vulnerability class and the NVD description. Attackers must already have network reachability to the Zebra daemon's routing port (typically TCP/179 for BGP) and must be able to legitimately establish a session, or, per the advisory, previously have been banned.

1. Reconnaissance / target identification: An adversary identifies a Zebra 2.3.0–6.3.x routing daemon reachable over the network, at minimum one whose routing port is exposed or reachable through an established peering fabric. In an IPv6 environment, the attacker determines the peer subnet (/64) from which their sessions are sourced. This can be accomplished through existing peering relationships or by observing the routing port from hosts within their allocation. There is no authentication prerequisite for the flaw itself (PR:N), so no credential harvesting is required. Attacker value lies in identifying a routing fabric that serves a target autonomous system.

2. Trigger the vulnerability class (user-identified misbehavior run-up): The attacker performs actions that generate misbehavior events against the daemon — for example, announcing routes inconsistent with policy, exceeding prefix thresholds, or inducing route churn. Because the daemon keys on exact IP addresses, any prior ban record attached to the attacker's current address exists only for that exact address. Note that the advisory's explicit framing is that attackers evade bans, meaning the attacker's goal is to make the daemon enforce a ban and then escape it.

3. Execute the evasion primitive: The attacker takes either of two paths identified in the advisory:

   • Path A (IPv6 re-addressing): After being banned on address X::a, the attacker reconnects from a different address X::b within the same /64 allocation. The daemon treats X::b as a new, clean peer with a zero misbehavior score, re-establishing the session.
   • Path B (ban-list flushing): The attacker, either by generating enough misbehavior events across sufficient distinct appearances or by other means, forces entries through the 20,000-entry FIFO list until the discarded record for their original address is evicted. On reconnect, the original banned address is no longer in the ban table, and the attacker's access is restored.

4. Post-exploitation impact: Having evaded the ban, the attacker sustains or restores the routing adjacency. This yields a route integrity impact (CVSS I:L): the attacker can continue advertising prefixes or maintain adjacencies that policy intended to deny. Consequences include route poisoning, prefix hijacking support, continued control-plane churn, defeating route-limit protections, and reduced operator ability to isolate an abusive peer. Because the evasion primitive requires no credentials and no user interaction, it is repeatable indefinitely, defeating the enforcement mechanism's deterrent purpose.

Impact Assessment

This is a low-severity, remote, unauthenticated availability-of-enforcement failure, rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The direct impact is limited to integrity of the daemon's enforcement state: bans and misbehavior scores can be circumvented, permitting an abusive peer to retain access. There is no information disclosure or direct availability impact to the affected system itself. Business impact concentrates on the control-plane integrity of networks running Zebra/FRR 2.3.0–6.3.x — internet service providers, data centers, cloud routing fabrics, and enterprise edge routers that deploy inter-domain or internal BGP and rely on Zebra's misbehavior scoring and ban mechanism as a defensive control. Because the mechanism is intended to contain malicious or malfunctioning peers, the flaw undermines trust in that containment capability. Attackers with an IP-transit advantage (IPv6 address space) gain a durable evasion path with low exploit complexity and no authentication. No CISA KEV listing, no public PoC, and no exploit activity is confirmed in this dataset; real-world impact is therefore currently assessed as potential rather than observed. Blast radius includes any operator who has tuned Zebra ban/misbehavior thresholds as a security boundary rather than a best-effort hygiene control.

Detection Guidance

Sigma Rule

title: Zebra Routing Daemon Ban Evasion Attempt (CVE-2026-109364)
id: 7b3f9c1e-2a4d-4c8e-9f10-4d5a6b7c8d90
status: experimental
description: Detects repeated session establishment from multiple exact IPv6 addresses within the same /64 or rapid churn of routing peer sessions, consistent with Zebra ban evasion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109364
author: SOC Team
logsource:
  product: linux
  service: zebra
detection:
  selection:
    process: "zebra"
    message|contains:
      - "peer state change"
      - "ban"
      - "misbehavior"
  timeframe: 15m
  condition: selection | count() by src_ip > 5
fields:
  - src_ip
  - message
falsepositives:
  - Legitimate route flapping during maintenance
  - IPv6 privacy-extension address rotation by authorized peers
level: medium

YARA Rule

rule CVE_2026_109364_Zebra_Ban_Evasion_Marker
{
    meta:
        description = "Detects Zebra source/log artifacts referencing ban list or misbehavior scoring structures associated with CVE-2026-109364"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109364"
        author = "SOC Team"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $s1 = "misbehavior" ascii wide nocase
        $s2 = "ban" ascii wide nocase
        $s3 = "fifo" ascii wide nocase
        $s4 = "20000" ascii wide
        $s5 = "peer" ascii wide nocase
    condition:
        uint16(0) != 0 and all of them
}

Suricata IDS Rule

alert tcp any any -> any 179 (msg:"CVE-2026-109364 Zebra Ban Evasion - repeated BGP session establishment from same IPv6 /64"; flow:to_server,established; threshold: type both, track by_src, count 5, seconds 60; classtype:policy-violation; sid:2026109364; rev:1;)
alert tcp any any -> any 2601 (msg:"CVE-2026-109364 Zebra Management - suspicious peer session churn"; flow:to_server,established; threshold: type both, track by_src, count 10, seconds 120; classtype:policy-violation; sid:2026109365; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=15m
  [network where network.transport == "tcp" and destination.port == 179]
  [network where network.transport == "tcp" and destination.port == 179]
  [network where network.transport == "tcp" and destination.port == 179]
  [network where network.transport == "tcp" and destination.port == 179]
  [network where network.transport == "tcp" and destination.port == 179]

Splunk SPL Query

index=network (dest_port=179 OR dest_port=2601)
| bin _time span=15m
| stats dc(src) as unique_srcs values(src) as src_list count by _time, dest
| where count > 5 AND unique_srcs > 1
| table _time dest count unique_srcs src_list

Note: operators should additionally parse the IPv6 /64 prefix from src and alert when multiple distinct source addresses within the same /64 trigger session establishments in a short window, which is the strongest behavioral signal of the re-addressing evasion path described in the advisory.

Wazuh OSSEC Rule

<group name="zebra,routing,">
  <rule id="100641" level="8">
    <decoded_as>syslog</decoded_as>
    <match>zebra</match>
    <regex>ban|misbehavior</regex>
    <description>CVE-2026-109364: Zebra misbehavior/ban event observed - possible ban evasion activity</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100642" level="10" frequency="5" timeframe="300">
    <if_matched_sid>100641</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-109364: Repeated Zebra misbehavior events from same source - likely ban evasion attempt</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 in this dataset, classified UNPATCHED — no patch evidence was identified from any tracked source. The NVD description states the flaw affects Zebra 2.3.0 before 6.4.0, so upgrading to 6.4.0 or later is the expected remediation once confirmed available; because patch telemetry is absent here, verify the vendor release before relying on it.

1. Immediate mitigations: Migrate ban and misbehavior enforcement from an exact-IP primitive to a prefix- and identity-aware primitive at the operator's perimeter — for example, enforce network-layer filtering (prefix lists, maximum-prefix limits) on routing peers at the router or firewall where bans are decided, so that evading the daemon's internal list does not restore reaching the daemon. Restrict routing port exposure to known peer address space. In IPv6 deployments, apply inbound filters that constrain a peer to a single validated /128 or tightly scoped prefix rather than allowing free re-selection across a /64. Monitor for session churn and repeated misbehavior events from multiple addresses in the same /64 and treat that as an enforcement gap rather than ordinary flapping.

2. Patch/upgrade steps: Identify all hosts running Zebra/FRR distributions derived from Zebra 2.3.0–6.3.x (the vulnerable range per NVD). Plan upgrade to Zebra 6.4.0 or later when the vendor release is confirmed. Stage in a lab, validate BGP/adjacency behavior and ban/misbehavior configuration semantics, then roll in a maintenance window. Because patch confidence is zero, do not assume a fix window based on this report alone — confirm against upstream release notes.

3. Long-term hardening: Treat routing-protocol misbehavior enforcement as defense-in-depth, not a sole control. Implement cryptographic channel authentication (TCP-AO / MD5 where used, plus RPKI origin validation) so identity is not merely the source address. Normalize and persist ban identity at the prefix or peer-ID level. Replace bounded FIFO ban structures with alerting when eviction is imminent, and retain audit records of ban events off-box so evictions can be reconstructed. Add monitoring that correlates ban events with subsequent reconnection attempts from within the same allocation.

References

1. NVD — CVE-2026-109364: https://nvd.nist.gov/vuln/detail/CVE-2026-109364
2. CWE-693 — Protection Mechanism Failure: https://cwe.mitre.org/data/definitions/693.html
3. FIRST EPSS — Not yet scored for this CVE (no EPSS value assigned at time of writing): https://www.first.org/epss/
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. Zebra / FRRouting project documentation for misbehavior scoring and maximum-prefix enforcement — consult upstream release notes for 6.4.0 to confirm remediation scope.

No threat actor campaign or exploit-in-the-wild evidence is available for CVE-2026-109364 in this dataset; no CISA KEV listing exists.