CVE-2026-41956: Traffic Management Microkernel DoS Flaw

CVE-2026-41956 Overview

CVE-2026-41956 is a denial-of-service vulnerability affecting F5 BIG-IP. When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. TMM is the core data-plane process responsible for handling all traffic through BIG-IP. Its termination disrupts traffic processing for every virtual server hosted on the affected instance. F5 notes that software versions which have reached End of Technical Support (EoTS) are not evaluated. The flaw is categorized under [CWE-121] Stack-Based Buffer Overflow and is reachable over the network without authentication or user interaction.

Critical Impact
Unauthenticated attackers can remotely terminate the TMM process on BIG-IP instances configured with a UDP classification profile, causing service-wide traffic disruption.

Affected Products

F5 BIG-IP instances with a classification profile attached to a UDP virtual server
BIG-IP versions covered in F5 Knowledge Article K000158038
Software versions in End of Technical Support (EoTS) are not evaluated by F5

Discovery Timeline

2026-05-13 - CVE-2026-41956 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-41956

Vulnerability Analysis

The vulnerability resides in the classification profile processing logic of the Traffic Management Microkernel (TMM) on F5 BIG-IP. TMM handles all data-plane traffic, including UDP virtual servers configured with classification profiles used for application identification and policy enforcement. Specially crafted requests trigger a memory-handling defect classified as [CWE-121] Stack-Based Buffer Overflow. The condition causes TMM to terminate, which interrupts traffic forwarding, load balancing, and any security policies enforced by the device.

Root Cause

The root cause is improper bounds handling within the classification engine when parsing UDP traffic against a configured classification profile. According to F5, the precise request content remains undisclosed. The CWE-121 classification indicates a fixed-size stack buffer is written beyond its allocated boundary during request processing. The result is process termination rather than confidentiality or integrity loss, consistent with the CVSS vector showing impact limited to availability.

Attack Vector

An attacker reaches the vulnerable code path by sending crafted UDP traffic to a virtual server that has a classification profile applied. Exploitation requires no authentication, no user interaction, and no prior access. Any network-reachable UDP virtual server with the affected configuration is exposed. Repeated triggering keeps TMM unstable and prevents the device from servicing legitimate clients. See F5 Knowledge Article K000158038 for vendor-confirmed details.

No public proof-of-concept code is available, and no verified code examples are published. The vulnerability is described in prose because F5 has not disclosed packet-level details.

Detection Methods for CVE-2026-41956

Indicators of Compromise

Unexpected TMM process restarts or core dumps on BIG-IP, often logged in /var/log/ltm with tmm crash entries
Brief or sustained traffic outages affecting all virtual servers on the same TMM instance
High-availability failover events triggered by TMM termination on the active unit

Detection Strategies

Monitor /var/log/ltm and /var/log/tmm for tmm segmentation faults, Tmm aborted messages, or repeated daemon restarts
Inspect virtual server configurations for UDP profiles paired with classification profiles using tmsh list ltm virtual and correlate with traffic loss events
Capture UDP traffic to affected virtual servers and review for anomalous payloads coinciding with TMM crashes

Monitoring Recommendations

Forward BIG-IP syslog, SNMP traps, and crash artifacts to a central SIEM for correlation with availability alerts
Alert on TMM restart counters and mcpd notifications indicating data-plane interruptions
Track failover frequency on HA pairs; repeated failovers driven by TMM termination indicate active exploitation attempts

How to Mitigate CVE-2026-41956

Immediate Actions Required

Apply the fixed BIG-IP version listed in F5 Knowledge Article K000158038 as soon as upgrade windows allow
Inventory all UDP virtual servers and identify those with classification profiles attached
Restrict network exposure of affected UDP virtual servers to trusted source ranges where feasible

Patch Information

F5 has published remediation guidance in F5 Knowledge Article K000158038. Administrators should consult the article for the list of fixed software branches and upgrade paths. Versions in End of Technical Support are not evaluated and should be migrated to a supported release.

Workarounds

Remove the classification profile from UDP virtual servers if the classification feature is not required
Apply source-address restrictions or upstream ACLs to limit which clients can reach UDP virtual servers using classification profiles
Use rate limiting on the affected UDP virtual servers to reduce the impact of repeated crash attempts pending patch deployment

bash

# Configuration example: list virtual servers and remove classification profile
tmsh list ltm virtual one-line | grep -i udp
tmsh modify ltm virtual <vs_name> profiles delete { <classification_profile_name> }
tmsh save sys config