CVE-2026-21912: Junos OS TOCTOU Race Condition Flaw

CVE-2026-21912 Overview

A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists in the method used to collect FPC Ethernet firmware statistics in Juniper Networks Junos OS on the MX10k Series. This vulnerability allows a local, low-privileged attacker to cause an LC480 or LC2101 line card to reset by repeatedly executing the show system firmware CLI command.

On affected MX10k Series systems with LC480 or LC2101 line cards, repeated execution of the show system firmware CLI command can cause the line card to crash and restart. Additionally, some time after the line card crashes, the chassisd daemon may also crash and restart, generating a core dump. This creates a denial of service condition that can significantly impact network availability.

Critical Impact

Local attackers with low-level CLI access can trigger line card resets and chassis daemon crashes, causing network service disruption on critical MX10k Series infrastructure.

Affected Products

• Juniper Networks Junos OS on MX10k Series - all versions before 21.2R3-S10
• Juniper Networks Junos OS on MX10k Series - from 21.4 before 21.4R3-S9
• Juniper Networks Junos OS on MX10k Series - from 22.2 before 22.2R3-S7
• Juniper Networks Junos OS on MX10k Series - from 22.4 before 22.4R3-S6
• Juniper Networks Junos OS on MX10k Series - from 23.2 before 23.2R2-S2
• Juniper Networks Junos OS on MX10k Series - from 23.4 before 23.4R2-S3
• Juniper Networks Junos OS on MX10k Series - from 24.2 before 24.2R2

Discovery Timeline

• 2026-01-15 - CVE-2026-21912 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-21912

Vulnerability Analysis

This vulnerability (CWE-367) is classified as a Time-of-check Time-of-use (TOCTOU) race condition affecting the firmware statistics collection mechanism within Junos OS. The vulnerability exists in the code path executed when a user invokes the show system firmware CLI command on MX10k Series routers equipped with LC480 or LC2101 line cards.

The flaw resides in how the system validates and subsequently accesses resources during the FPC Ethernet firmware statistics collection process. A time gap exists between when the system checks a resource's state and when it actually uses that resource, creating an exploitable window. A local attacker with low-level privileges can exploit this race condition by repeatedly executing the vulnerable CLI command, causing the firmware statistics collection routine to access inconsistent data states.

Root Cause

The root cause is a classic TOCTOU race condition in the FPC Ethernet firmware statistics collection code. When the show system firmware command is executed, the system performs a check on certain firmware data structures, but before it can safely use those checked values, the state can change due to concurrent operations. This temporal gap allows the race condition to manifest, particularly under repeated command execution scenarios.

The race condition specifically affects the LC480 and LC2101 line cards, suggesting these models have unique firmware statistics collection routines or data structures that are susceptible to this timing vulnerability. The fact that the chassisd daemon can also crash following line card failures indicates a cascade effect where the chassis management process encounters unexpected states when handling line card recovery.

Attack Vector

The attack requires local access to the Junos OS CLI with low-level privileges. An authenticated attacker positioned on the device can trigger the vulnerability through the following attack pattern:

The attacker repeatedly executes the show system firmware CLI command on an affected MX10k Series device. The rapid, repeated execution of this command triggers the race condition in the firmware statistics collection routine. The timing window between the check and use phases is exploited, causing memory corruption or inconsistent state access that leads to the LC480 or LC2101 line card crashing.

Following the line card crash, the chassisd process may subsequently crash due to encountering unexpected states during line card recovery operations. This results in a core dump being generated and further service disruption as the chassis management daemon restarts.

Detection Methods for CVE-2026-21912

Indicators of Compromise

• Repeated or unusual execution patterns of the show system firmware CLI command in system logs
• Unexpected LC480 or LC2101 line card resets without hardware or configuration changes
• Core dumps generated by the chassisd daemon following line card failures
• Increased frequency of FPC restart events correlated with user CLI activity

Detection Strategies

• Monitor Junos OS system logs for excessive show system firmware command executions from non-administrative users
• Implement alerting on unexpected line card reset events on MX10k Series devices with LC480 or LC2101 cards
• Configure syslog forwarding to capture and analyze chassisd crash events and core dump generation
• Deploy behavioral monitoring to detect anomalous CLI command patterns from user accounts

Monitoring Recommendations

• Enable enhanced logging for CLI command execution auditing on all MX10k Series devices
• Configure SNMP traps for FPC and line card state change events
• Implement centralized log collection for correlation of command execution with hardware events
• Review user access permissions and limit show system firmware access to trusted administrators

How to Mitigate CVE-2026-21912

Immediate Actions Required

• Upgrade affected Junos OS installations to patched versions as specified in the Juniper advisory
• Restrict CLI access to the show system firmware command to only trusted, high-privilege administrators
• Monitor for unusual line card reset patterns on MX10k Series devices with LC480 or LC2101 cards
• Implement access controls to limit local device access to authorized personnel only

Patch Information

Juniper Networks has released security updates to address this vulnerability. Organizations should upgrade to the following fixed versions based on their current deployment:

• Upgrade to 21.2R3-S10 or later for the 21.2 release train
• Upgrade to 21.4R3-S9 or later for the 21.4 release train
• Upgrade to 22.2R3-S7 or later for the 22.2 release train
• Upgrade to 22.4R3-S6 or later for the 22.4 release train
• Upgrade to 23.2R2-S2 or later for the 23.2 release train
• Upgrade to 23.4R2-S3 or later for the 23.4 release train
• Upgrade to 24.2R2 or later for the 24.2 release train

For complete patch details and download links, refer to the Juniper Security Advisory JSA106011.

Workarounds

• Implement CLI access controls using Junos OS login classes to restrict show system firmware command access
• Configure AAA (Authentication, Authorization, and Accounting) to limit command authorization for low-privileged users
• Consider using read-only user accounts with explicit command denials for firmware-related show commands
• Implement rate limiting on CLI sessions to reduce the feasibility of rapid command execution attacks

# Example: Restrict show system firmware command using login class
set system login class restricted-operator permissions view
set system login class restricted-operator deny-commands "show system firmware"
set system login user limited-user class restricted-operator