CVE-2025-61105: 
CBL Mariner vulnerability analysis and mitigation

FRRouting/frr from v4.0 through v10.4.1 contains a NULL pointer dereference vulnerability in the show_vty_link_info function at ospf_ext.c. The vulnerability was discovered and disclosed on October 27, 2025, affecting multiple versions of the FRRouting software (NVD).

The vulnerability occurs when the 'debug ospf packet all send/recv detail' command is enabled in the OSPF configuration. When ospfd processes an LS Update packet containing an opaque LSA, a NULL pointer dereference occurs in show_opaque_info_detail() within ospfd/ospf_opaque.c. The vulnerability has received a CVSS v3.1 base score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet. When exploited, it results in the crash of the ospfd daemon, disrupting OSPF routing operations (NVD, GitHub Issue).

A fix has been developed that adds proper security checks for VTY context and pointers related to Opaque LSAs dumping. The patch ensures that if the VTY context is unavailable, packet details are logged using zlog instead. The fix is available through a pull request that addresses the NULL pointer dereference issues (GitHub PR).