Ubuntu USN-7230-3 fixes an FRR RPKI regression
Ubuntu USN-7230-3 repairs an RPKI regression in FRR caused by an earlier fix. See who is affected, how to check a server and how to confirm the fix.
TL;DR: Ubuntu USN-7230-3 repairs a regression in the FRR routing suite: the earlier fix for CVE-2024-55553 left FRR ignoring every RPKI update after the first. If you run FRR on Ubuntu, take the corrected package.
What happened
Ubuntu Security Notices published USN-7230-3 on November 5, 2026. USN-7230-2 had fixed vulnerabilities in FRR, including CVE-2024-55553, a flaw that could let a remote attacker degrade performance through repeated route revalidation. That fix broke RPKI support: after one update, FRR ignored later ones, so routes were no longer revalidated when RPKI data changed. On Ubuntu 20.04 LTS the BGP daemon would not even start with the RPKI module turned on. The original advisory also covered CVE-2024-44070, a flaw in BGP message handling that could crash FRR.
Am I affected?
You are affected if you run FRR from the Ubuntu package and use RPKI route validation, or if a BGP daemon on Ubuntu 20.04 LTS no longer starts after the earlier update. Run vtysh -c "show version" to see the installed version and compare it with the notice. Without the fix you must choose between a routing regression and two known flaws, so install the corrected package.
How to check with Stackurity
Stackurity reads installed packages on Ubuntu servers and matches them against vendor advisories, backports included, so you can list every server that still needs the corrected FRR package. Appliance firmware is not covered, including routers that run their own images. After you update, check again records whether the issue is gone. See how Stackurity verifies fixes. Stackurity Cloud has a 14-day free trial without a card: Start a free trial.
