diff mbox series

[meta-networking,1/2] frr: upgrade 10.5.3 -> 10.6.1

Message ID 20260423014819.945909-1-yi.zhao@windriver.com
State Under Review
Headers show
Series [meta-networking,1/2] frr: upgrade 10.5.3 -> 10.6.1 | expand

Commit Message

Yi Zhao April 23, 2026, 1:48 a.m. UTC
ChangeLog:
https://github.com/FRRouting/frr/releases/tag/frr-10.6.0
https://github.com/FRRouting/frr/releases/tag/frr-10.6.1

Drop backport patches.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 .../frr/frr/CVE-2025-61099-61107-1.patch      |  40 ---
 .../frr/frr/CVE-2025-61099-61107-2.patch      |  80 -----
 .../frr/frr/CVE-2025-61099-61107-3.patch      | 293 ------------------
 .../frr/{frr_10.5.3.bb => frr_10.6.1.bb}      |   7 +-
 4 files changed, 2 insertions(+), 418 deletions(-)
 delete mode 100644 meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-1.patch
 delete mode 100644 meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-2.patch
 delete mode 100644 meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-3.patch
 rename meta-networking/recipes-protocols/frr/{frr_10.5.3.bb => frr_10.6.1.bb} (94%)
diff mbox series

Patch

diff --git a/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-1.patch b/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-1.patch
deleted file mode 100644
index a1e1246cce..0000000000
--- a/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-1.patch
+++ /dev/null
@@ -1,40 +0,0 @@ 
-From e21276d430663fd8312940bb3b0ce081957e3d85 Mon Sep 17 00:00:00 2001
-From: Gyorgy Sarvari <skandigraun@gmail.com>
-Date: Sun, 24 Aug 2025 21:17:55 +0800
-Subject: [PATCH] ospfd: Add null check for vty_out in check_tlv_size
-
-From: s1awwhy <seawwhy@163.com>
-
-Add security check for vty_out. Specifically,  Check NULL for vty. If vty is not available, dump info via zlog.
-
-Signed-off-by: s1awwhy <seawwhy@163.com>
-
-CVE: CVE-2025-61099 CVE-2025-61100 CVE-2025-61101 CVE-2025-61102 CVE-2025-61103 CVE-2025-61104 CVE-2025-61105 CVE-2025-61106 CVE-2025-61107
-Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/b7d9b7aa47627b31e4b50795284408ab6de98660]
-Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
----
- ospfd/ospf_ext.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/ospfd/ospf_ext.c b/ospfd/ospf_ext.c
-index df0b3b9081..8ca0df3200 100644
---- a/ospfd/ospf_ext.c
-+++ b/ospfd/ospf_ext.c
-@@ -1705,11 +1705,15 @@ static void ospf_ext_lsa_schedule(struct ext_itf *exti, enum lsa_opcode op)
-  * ------------------------------------
-  */
- 
-+/* Check NULL for vty. If vty is not available, dump info via zlog */
- #define check_tlv_size(size, msg)                                              \
- 	do {                                                                   \
- 		if (ntohs(tlvh->length) != size) {                             \
--			vty_out(vty, "  Wrong %s TLV size: %d(%d). Abort!\n",  \
--				msg, ntohs(tlvh->length), size);               \
-+			if (vty != NULL)                         \
-+				vty_out(vty, "  Wrong %s TLV size: %d(%d). Abort!\n",  \
-+					msg, ntohs(tlvh->length), size);               \
-+			else                                              \
-+				zlog_debug("    Wrong %s TLV size: %d(%d). Abort!", msg, ntohs(tlvh->length), size);    \
- 			return size + TLV_HDR_SIZE;                            \
- 		}                                                              \
- 	} while (0)
diff --git a/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-2.patch b/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-2.patch
deleted file mode 100644
index eacada0ec4..0000000000
--- a/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-2.patch
+++ /dev/null
@@ -1,80 +0,0 @@ 
-From d9ed123b814dad7cf4b069de5601c9f279596191 Mon Sep 17 00:00:00 2001
-From: Gyorgy Sarvari <skandigraun@gmail.com>
-Date: Tue, 6 Jan 2026 15:32:32 +0100
-Subject: [PATCH] ospfd: skip subsequent tlvs after invalid length
-
-From: Louis Scalbert <louis.scalbert@6wind.com>
-
-Do not attempt to read subsequent TLVs after an TLV invalid length is
-detected.
-
-Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
-
-CVE: CVE-2025-61099 CVE-2025-61100 CVE-2025-61101 CVE-2025-61102 CVE-2025-61103 CVE-2025-61104 CVE-2025-61105 CVE-2025-61106 CVE-2025-61107
-Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/33dfc7e7be1ac8b66abbf47c30a709215fbc1926]
-Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
----
- ospfd/ospf_ext.c | 6 +++---
- ospfd/ospf_ri.c  | 6 +++---
- ospfd/ospf_te.c  | 6 +++---
- 3 files changed, 9 insertions(+), 9 deletions(-)
-
-diff --git a/ospfd/ospf_ext.c b/ospfd/ospf_ext.c
-index 8ca0df3200..62b0020148 100644
---- a/ospfd/ospf_ext.c
-+++ b/ospfd/ospf_ext.c
-@@ -1710,11 +1710,11 @@ static void ospf_ext_lsa_schedule(struct ext_itf *exti, enum lsa_opcode op)
- 	do {                                                                   \
- 		if (ntohs(tlvh->length) != size) {                             \
- 			if (vty != NULL)                         \
--				vty_out(vty, "  Wrong %s TLV size: %d(%d). Abort!\n",  \
-+				vty_out(vty, "  Wrong %s TLV size: %d(expected %d). Skip subsequent TLVs!\n",  \
- 					msg, ntohs(tlvh->length), size);               \
- 			else                                              \
--				zlog_debug("    Wrong %s TLV size: %d(%d). Abort!", msg, ntohs(tlvh->length), size);    \
--			return size + TLV_HDR_SIZE;                            \
-+				zlog_debug("    Wrong %s TLV size: %d(expected %d). Skip subsequent TLVs!", msg, ntohs(tlvh->length), size);    \
-+			return OSPF_MAX_LSA_SIZE + 1;                            \
- 		}                                                              \
- 	} while (0)
- 
-diff --git a/ospfd/ospf_ri.c b/ospfd/ospf_ri.c
-index 76e6efeb83..7934b25451 100644
---- a/ospfd/ospf_ri.c
-+++ b/ospfd/ospf_ri.c
-@@ -1208,12 +1208,12 @@ static int ospf_router_info_lsa_update(struct ospf_lsa *lsa)
- 	do {                                                                   \
- 		if (ntohs(tlvh->length) > size) {                              \
- 			if (vty != NULL)                                       \
--				vty_out(vty, "  Wrong %s TLV size: %d(%d)\n",  \
-+				vty_out(vty, "  Wrong %s TLV size: %d(expected %d). Skip subsequent TLVs!\n",  \
- 					msg, ntohs(tlvh->length), size);       \
- 			else                                                   \
--				zlog_debug("    Wrong %s TLV size: %d(%d)",    \
-+				zlog_debug("    Wrong %s TLV size: %d(expected %d). Skip subsequent TLVs!",    \
- 					   msg, ntohs(tlvh->length), size);    \
--			return size + TLV_HDR_SIZE;                            \
-+			return OSPF_MAX_LSA_SIZE + 1;                            \
- 		}                                                              \
- 	} while (0)
- 
-diff --git a/ospfd/ospf_te.c b/ospfd/ospf_te.c
-index d187485b9f..850a7039f1 100644
---- a/ospfd/ospf_te.c
-+++ b/ospfd/ospf_te.c
-@@ -3161,12 +3161,12 @@ static void ospf_te_init_ted(struct ls_ted *ted, struct ospf *ospf)
- 	do {                                                                   \
- 		if (ntohs(tlvh->length) > size) {                              \
- 			if (vty != NULL)                                       \
--				vty_out(vty, "  Wrong %s TLV size: %d(%d)\n",  \
-+				vty_out(vty, "  Wrong %s TLV size: %d(expected %d). Skip subsequent TLVs!\n",  \
- 					msg, ntohs(tlvh->length), size);       \
- 			else                                                   \
--				zlog_debug("    Wrong %s TLV size: %d(%d)",    \
-+				zlog_debug("    Wrong %s TLV size: %d(expected %d). Skip subsequent TLVs!",    \
- 					   msg, ntohs(tlvh->length), size);    \
--			return size + TLV_HDR_SIZE;                            \
-+			return OSPF_MAX_LSA_SIZE + 1;                            \
- 		}                                                              \
- 	} while (0)
- 
diff --git a/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-3.patch b/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-3.patch
deleted file mode 100644
index 7b983198f5..0000000000
--- a/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-3.patch
+++ /dev/null
@@ -1,293 +0,0 @@ 
-From 2d02bca97251ee53fb10b4c34c8cda0e20ae8b8e Mon Sep 17 00:00:00 2001
-From: Gyorgy Sarvari <skandigraun@gmail.com>
-Date: Sun, 24 Aug 2025 21:21:23 +0800
-Subject: [PATCH] ospfd: Fix NULL Pointer Deference when dumping link info
-
-From: s1awwhy <seawwhy@163.com>
-
-When the command debug ospf packet all send/recv detail is enabled in the OSPF
-configuration,  ospfd will dump detailed information of any received or sent
-OSPF packets, either via VTY or through the zlog. However, the original Opaque
-LSA handling code failed to check whether the VTY context and show_opaque_info
-were available, resulting in NULL pointer dereference and crashes in ospfd.
-The patch fixes the Null Pointer Deference Vulnerability in
-show_vty_ext_link_rmt_itf_addr, show_vty_ext_link_adj_sid,
-show_vty_ext_link_lan_adj_sid, show_vty_unknown_tlv,
-show_vty_link_info, show_vty_ext_pref_pref_sid, show_vtY_pref_info.
-Specifically, add NULL check for vty. If vty is not available, dump details
-via zlog.
-
-Signed-off-by: s1awwhy <seawwhy@163.com>
-Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
-
-CVE: CVE-2025-61099 CVE-2025-61100 CVE-2025-61101 CVE-2025-61102 CVE-2025-61103 CVE-2025-61104 CVE-2025-61105 CVE-2025-61106 CVE-2025-61107
-Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/034e6fe67078810b952630055614ee5710d1196e]
-Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
----
- ospfd/ospf_ext.c | 200 ++++++++++++++++++++++++++++++++---------------
- 1 file changed, 138 insertions(+), 62 deletions(-)
-
-diff --git a/ospfd/ospf_ext.c b/ospfd/ospf_ext.c
-index 62b0020148..c1fcd632e0 100644
---- a/ospfd/ospf_ext.c
-+++ b/ospfd/ospf_ext.c
-@@ -1729,9 +1729,15 @@ static uint16_t show_vty_ext_link_rmt_itf_addr(struct vty *vty,
- 	check_tlv_size(EXT_SUBTLV_RMT_ITF_ADDR_SIZE, "Remote Itf. Address");
- 
- 	if (!json)
--		vty_out(vty,
--			"  Remote Interface Address Sub-TLV: Length %u\n	Address: %pI4\n",
--			ntohs(top->header.length), &top->value);
-+		if (vty != NULL) {
-+			vty_out(vty,
-+				"  Remote Interface Address Sub-TLV: Length %u\n	Address: %pI4\n",
-+				ntohs(top->header.length), &top->value);
-+		} else {
-+			zlog_debug("  Remote Interface Address Sub-TLV: Length %u",
-+				   ntohs(top->header.length));
-+			zlog_debug("  Address: %pI4", &top->value);
-+		}
- 	else
- 		json_object_string_addf(json, "remoteInterfaceAddress", "%pI4",
- 					&top->value);
-@@ -1752,18 +1758,30 @@ static uint16_t show_vty_ext_link_adj_sid(struct vty *vty,
- 			      : SID_INDEX_SIZE(EXT_SUBTLV_ADJ_SID_SIZE);
- 	check_tlv_size(tlv_size, "Adjacency SID");
- 
--	if (!json)
--		vty_out(vty,
--			"  Adj-SID Sub-TLV: Length %u\n\tFlags: 0x%x\n\tMT-ID:0x%x\n\tWeight: 0x%x\n\t%s: %u\n",
--			ntohs(top->header.length), top->flags, top->mtid,
--			top->weight,
--			CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
--				? "Label"
--				: "Index",
--			CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
--				? GET_LABEL(ntohl(top->value))
--				: ntohl(top->value));
--	else {
-+	if (!json) {
-+		/* Add security check for vty_out. If vty is not available, dump info via zlog.*/
-+		if (vty != NULL)
-+			vty_out(vty,
-+				"  Adj-SID Sub-TLV: Length %u\n\tFlags: 0x%x\n\tMT-ID:0x%x\n\tWeight: 0x%x\n\t%s: %u\n",
-+				ntohs(top->header.length), top->flags, top->mtid, top->weight,
-+				CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG) ? "Label"
-+										     : "Index",
-+				CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
-+					? GET_LABEL(ntohl(top->value))
-+					: ntohl(top->value));
-+		else {
-+			zlog_debug("  Adj-SID Sub-TLV: Length %u", ntohs(top->header.length));
-+			zlog_debug("    Flags: 0x%x", top->flags);
-+			zlog_debug("    MT-ID:0x%x", top->mtid);
-+			zlog_debug("    Weight: 0x%x", top->weight);
-+			zlog_debug("    %s: %u",
-+				   CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG) ? "Label"
-+											: "Index",
-+				   CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
-+					   ? GET_LABEL(ntohl(top->value))
-+					   : ntohl(top->value));
-+		}
-+	} else {
- 		json_object_string_addf(json, "flags", "0x%x", top->flags);
- 		json_object_string_addf(json, "mtID", "0x%x", top->mtid);
- 		json_object_string_addf(json, "weight", "0x%x", top->weight);
-@@ -1791,18 +1809,32 @@ static uint16_t show_vty_ext_link_lan_adj_sid(struct vty *vty,
- 			      : SID_INDEX_SIZE(EXT_SUBTLV_LAN_ADJ_SID_SIZE);
- 	check_tlv_size(tlv_size, "LAN-Adjacency SID");
- 
--	if (!json)
--		vty_out(vty,
--			"  LAN-Adj-SID Sub-TLV: Length %u\n\tFlags: 0x%x\n\tMT-ID:0x%x\n\tWeight: 0x%x\n\tNeighbor ID: %pI4\n\t%s: %u\n",
--			ntohs(top->header.length), top->flags, top->mtid,
--			top->weight, &top->neighbor_id,
--			CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
--				? "Label"
--				: "Index",
--			CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
--				? GET_LABEL(ntohl(top->value))
--				: ntohl(top->value));
--	else {
-+	if (!json) {
-+		/* Add security check for vty_out. If vty is not available, dump info via zlog. */
-+		if (vty != NULL) {
-+			vty_out(vty,
-+				"  LAN-Adj-SID Sub-TLV: Length %u\n\tFlags: 0x%x\n\tMT-ID:0x%x\n\tWeight: 0x%x\n\tNeighbor ID: %pI4\n\t%s: %u\n",
-+				ntohs(top->header.length), top->flags, top->mtid, top->weight,
-+				&top->neighbor_id,
-+				CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG) ? "Label"
-+										     : "Index",
-+				CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
-+					? GET_LABEL(ntohl(top->value))
-+					: ntohl(top->value));
-+		} else {
-+			zlog_debug("  LAN-Adj-SID Sub-TLV: Length %u", ntohs(top->header.length));
-+			zlog_debug("    Flags: 0x%x", top->flags);
-+			zlog_debug("    MT-ID:0x%x", top->mtid);
-+			zlog_debug("    Weight: 0x%x", top->weight);
-+			zlog_debug("    Neighbor ID: %pI4", &top->neighbor_id);
-+			zlog_debug("    %s: %u",
-+				   CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG) ? "Label"
-+											: "Index",
-+				   CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
-+					   ? GET_LABEL(ntohl(top->value))
-+					   : ntohl(top->value));
-+		}
-+	} else {
- 		json_object_string_addf(json, "flags", "0x%x", top->flags);
- 		json_object_string_addf(json, "mtID", "0x%x", top->mtid);
- 		json_object_string_addf(json, "weight", "0x%x", top->weight);
-@@ -1823,14 +1855,23 @@ static uint16_t show_vty_unknown_tlv(struct vty *vty, struct tlv_header *tlvh,
- {
- 	json_object *obj;
- 
-+	/* Add security check for vty_out. If vty is not available, dump info via zlog. */
- 	if (TLV_SIZE(tlvh) > buf_size) {
--		vty_out(vty, "    TLV size %d exceeds buffer size. Abort!",
--			TLV_SIZE(tlvh));
-+		if (vty != NULL)
-+			vty_out(vty, "    TLV size %d exceeds buffer size. Abort!", TLV_SIZE(tlvh));
-+		else
-+			zlog_debug("    TLV size %d exceeds buffer size. Abort!", TLV_SIZE(tlvh));
-+
- 		return buf_size;
- 	}
- 	if (!json)
--		vty_out(vty, "    Unknown TLV: [type(0x%x), length(0x%x)]\n",
--			ntohs(tlvh->type), ntohs(tlvh->length));
-+		if (vty != NULL) {
-+			vty_out(vty, "    Unknown TLV: [type(0x%x), length(0x%x)]\n",
-+				ntohs(tlvh->type), ntohs(tlvh->length));
-+		} else {
-+			zlog_debug("    Unknown TLV: [type(0x%x), length(0x%x)]",
-+				   ntohs(tlvh->type), ntohs(tlvh->length));
-+		}
- 	else {
- 		obj = json_object_new_object();
- 		json_object_string_addf(obj, "type", "0x%x",
-@@ -1855,19 +1896,31 @@ static uint16_t show_vty_link_info(struct vty *vty, struct tlv_header *ext,
- 
- 	/* Verify that TLV length is valid against remaining buffer size */
- 	if (length > buf_size) {
--		vty_out(vty,
--			"  Extended Link TLV size %d exceeds buffer size. Abort!\n",
--			length);
-+		/* Add security check for vty_out. If vty is not available, dump info via zlog. */
-+		if (vty != NULL) {
-+			vty_out(vty, "  Extended Link TLV size %d exceeds buffer size. Abort!\n",
-+				length);
-+		} else {
-+			zlog_debug("  Extended Link TLV size %d exceeds buffer size. Abort!",
-+				   length);
-+		}
- 		return buf_size;
- 	}
- 
- 	if (!json) {
--		vty_out(vty,
--			"  Extended Link TLV: Length %u\n	Link Type: 0x%x\n"
--			"	Link ID: %pI4\n",
--			ntohs(top->header.length), top->link_type,
--			&top->link_id);
--		vty_out(vty, "	Link data: %pI4\n", &top->link_data);
-+		/* Add security check for vty_out. If vty is not available, dump info via zlog. */
-+		if (vty != NULL) {
-+			vty_out(vty,
-+				"  Extended Link TLV: Length %u\n	Link Type: 0x%x\n"
-+				"	Link ID: %pI4\n",
-+				ntohs(top->header.length), top->link_type, &top->link_id);
-+			vty_out(vty, "	Link data: %pI4\n", &top->link_data);
-+		} else {
-+			zlog_debug("  Extended Link TLV: Length %u", ntohs(top->header.length));
-+			zlog_debug("    Link Type: 0x%x", top->link_type);
-+			zlog_debug("    Link ID: %pI4", &top->link_id);
-+			zlog_debug("    Link data: %pI4", &top->link_data);
-+		}
- 	} else {
- 		json_object_string_addf(json, "linkType", "0x%x",
- 					top->link_type);
-@@ -1959,18 +2012,29 @@ static uint16_t show_vty_ext_pref_pref_sid(struct vty *vty,
- 			      : SID_INDEX_SIZE(EXT_SUBTLV_PREFIX_SID_SIZE);
- 	check_tlv_size(tlv_size, "Prefix SID");
- 
--	if (!json)
--		vty_out(vty,
--			"  Prefix SID Sub-TLV: Length %u\n\tAlgorithm: %u\n\tFlags: 0x%x\n\tMT-ID:0x%x\n\t%s: %u\n",
--			ntohs(top->header.length), top->algorithm, top->flags,
--			top->mtid,
--			CHECK_FLAG(top->flags, EXT_SUBTLV_PREFIX_SID_VFLG)
--				? "Label"
--				: "Index",
--			CHECK_FLAG(top->flags, EXT_SUBTLV_PREFIX_SID_VFLG)
--				? GET_LABEL(ntohl(top->value))
--				: ntohl(top->value));
--	else {
-+	if (!json) {
-+		if (vty != NULL) {
-+			vty_out(vty,
-+				"  Prefix SID Sub-TLV: Length %u\n\tAlgorithm: %u\n\tFlags: 0x%x\n\tMT-ID:0x%x\n\t%s: %u\n",
-+				ntohs(top->header.length), top->algorithm, top->flags, top->mtid,
-+				CHECK_FLAG(top->flags, EXT_SUBTLV_PREFIX_SID_VFLG) ? "Label"
-+										   : "Index",
-+				CHECK_FLAG(top->flags, EXT_SUBTLV_PREFIX_SID_VFLG)
-+					? GET_LABEL(ntohl(top->value))
-+					: ntohl(top->value));
-+		} else {
-+			zlog_debug("  Prefix SID Sub-TLV: Length %u", ntohs(top->header.length));
-+			zlog_debug("    Algorithm: %u", top->algorithm);
-+			zlog_debug("    Flags: 0x%x", top->flags);
-+			zlog_debug("    MT-ID:0x%x", top->mtid);
-+			zlog_debug("    %s: %u",
-+				   CHECK_FLAG(top->flags, EXT_SUBTLV_PREFIX_SID_VFLG) ? "Label"
-+										      : "Index",
-+				   CHECK_FLAG(top->flags, EXT_SUBTLV_PREFIX_SID_VFLG)
-+					   ? GET_LABEL(ntohl(top->value))
-+					   : ntohl(top->value));
-+		}
-+	} else {
- 		json_object_int_add(json, "algorithm", top->algorithm);
- 		json_object_string_addf(json, "flags", "0x%x", top->flags);
- 		json_object_string_addf(json, "mtID", "0x%x", top->mtid);
-@@ -1995,19 +2059,31 @@ static uint16_t show_vty_pref_info(struct vty *vty, struct tlv_header *ext,
- 
- 	/* Verify that TLV length is valid against remaining buffer size */
- 	if (length > buf_size) {
--		vty_out(vty,
--			"  Extended Link TLV size %d exceeds buffer size. Abort!\n",
--			length);
-+		if (vty != NULL) {
-+			vty_out(vty, "  Extended Link TLV size %d exceeds buffer size. Abort!\n",
-+				length);
-+		} else {
-+			zlog_debug("  Extended Link TLV size %d exceeds buffer size. Abort!",
-+				   length);
-+		}
- 		return buf_size;
- 	}
- 
--	if (!json)
--		vty_out(vty,
--			"  Extended Prefix TLV: Length %u\n\tRoute Type: %u\n"
--			"\tAddress Family: 0x%x\n\tFlags: 0x%x\n\tAddress: %pI4/%u\n",
--			ntohs(top->header.length), top->route_type, top->af,
--			top->flags, &top->address, top->pref_length);
--	else {
-+	if (!json) {
-+		if (vty != NULL) {
-+			vty_out(vty,
-+				"  Extended Prefix TLV: Length %u\n\tRoute Type: %u\n"
-+				"\tAddress Family: 0x%x\n\tFlags: 0x%x\n\tAddress: %pI4/%u\n",
-+				ntohs(top->header.length), top->route_type, top->af, top->flags,
-+				&top->address, top->pref_length);
-+		} else {
-+			zlog_debug("  Extended Prefix TLV: Length %u", ntohs(top->header.length));
-+			zlog_debug("    Route Type: %u", top->route_type);
-+			zlog_debug("    Address Family: 0x%x", top->af);
-+			zlog_debug("    Flags: 0x%x", top->flags);
-+			zlog_debug("    Address: %pI4/%u", &top->address, top->pref_length);
-+		}
-+	} else {
- 		json_object_int_add(json, "routeType", top->route_type);
- 		json_object_string_addf(json, "addressFamily", "0x%x", top->af);
- 		json_object_string_addf(json, "flags", "0x%x", top->flags);
diff --git a/meta-networking/recipes-protocols/frr/frr_10.5.3.bb b/meta-networking/recipes-protocols/frr/frr_10.6.1.bb
similarity index 94%
rename from meta-networking/recipes-protocols/frr/frr_10.5.3.bb
rename to meta-networking/recipes-protocols/frr/frr_10.6.1.bb
index 1c06f7bda5..e86e0f3153 100644
--- a/meta-networking/recipes-protocols/frr/frr_10.5.3.bb
+++ b/meta-networking/recipes-protocols/frr/frr_10.6.1.bb
@@ -10,13 +10,10 @@  LIC_FILES_CHKSUM = "file://doc/licenses/GPL-2.0;md5=b234ee4d69f5fce4486a80fdaf4a
                     file://doc/licenses/LGPL-2.1;md5=4fbd65380cdd255951079008b364516c"
 
 
-SRC_URI = "git://github.com/FRRouting/frr.git;protocol=https;nobranch=1;tag=frr-${PV} \
+SRC_URI = "git://github.com/FRRouting/frr.git;protocol=https;branch=stable/10.6;tag=frr-${PV} \
            file://frr.pam \
-           file://CVE-2025-61099-61107-1.patch \
-           file://CVE-2025-61099-61107-2.patch \
-           file://CVE-2025-61099-61107-3.patch \
            "
-SRCREV = "cd39d029a48a1e58929a7f31e7d61a594c2ecb42"
+SRCREV = "71da51baee6fb2a02b24262defc46591c86e8a81"
 
 UPSTREAM_CHECK_GITTAGREGEX = "frr-(?P<pver>\d+(\.\d+)+)$"