USN-7230-3: FRR January 2025 patch broke RPKI validation

Anyone running BGP routers with FRR on Ubuntu using RPKI to validate routes needs to update again. Advisory USN-7230-3, published by Ubuntu on 5 November 2026, addresses a regression introduced by the previous security patch, USN-7230-2, released on 27 January 2025.

What broke

The fix for CVE-2024-55553 introduced a regression in RPKI support, causing FRR to stop processing RPKI updates after the first one, meaning routes were no longer revalidated when RPKI data changed. On Ubuntu 20.04 LTS the impact was worse: the BGP daemon would not start at all when the RPKI module was enabled.

In practice, on a router with RPKI active, after the January 2025 patch routes remained validated (or invalidated) based on the initial RPKI data pull, with no further updates. Anyone managing BGP peering with origin validation enabled and relying on RPKI to block route leaks and hijacks has been operating with potentially stale data during this period.

The original bug

The underlying vulnerability, CVE-2024-55553, involved handling updates received via RTR: when the total updates exceeded the size of the internal socket buffer (4 KB by default on most operating systems), FRR would revalidate all routes in the RIB, with a performance impact that could escalate to denial of service. The FRRouting project had resolved the issue upstream in versions 10.0.3, 10.1.2, 10.2.1 and 10.3.

Packages to update

Ubuntu Release	Package	Correct version
24.04 LTS (noble)	frr-rpki-rtrlib	8.4.4-1.1ubuntu6.8
22.04 LTS (jammy)	frr-rpki-rtrlib	8.1-1ubuntu1.17
20.04 LTS (focal)	frr	7.2.1-1ubuntu0.2+esm5 (requires Ubuntu Pro via ESM Apps)

For Ubuntu 20.04, the fix is available only with Ubuntu Pro via ESM Apps; Ubuntu notes that a community fix may become available in future. On the other releases, the standard system update (apt update && apt upgrade) is sufficient. Anyone with RPKI active on an Ubuntu router running FRR should verify after the update that route revalidation has resumed: restarting the bgpd daemon or reloading the RTR session is the quickest verification method.