Cumulus Linux 5.11 Release Notes

Download 5.11 Release Notes xls    Download all 5.11 release notes as .xls

5.11.0 Release Notes

Open Issues in 5.11.0

Issue ID Description Affects Fixed
4203748
If you include a comma in the BGP community list, extended community list, or large community list regex expression of a routing policy, you see error messages and FRR reload fails. Make sure the regex expression does not contain a comma. 5.11.0
4200961
If you use a bridge name that isn’t br_default, NVUE generates incorrect ptp4l.conf files. 5.10.0-5.11.0
4200952
Configuring the listening-address for the SNMP server fails for IP addresses associated with VRFs other than the management VRF. 5.11.0
4198683
Configuring the listening-address for the SNMP server fails for IP addresses associated with VRFs other than the management VRF. 5.11.0
4185426
When you add a new MLAG bond, the BPDU guard state of its peer is initialized to False and immediately updated correctly after resync if the bond is up. If the bond is down, resync is not done and the peer PBDU guard state is not updated, which leads to a conflict if the local PBDU guard is enabled.
Even though it seems that PBDU configuration does not match between MLAG peers, this issue does not have any functional impact. It gets cleared when the bond becomes up.
5.9.2-5.11.0
4183214
If you upgrade the switch from Cumulus Linux 5.9.x or 5.10.x to Cumulus Linux 5.11.0 or later with package upgrade and Radius is enabled, you see configuration and commit errors. To avoid this issue, either disable Radius during package upgrade or disable Radius before package upgrade with the sudo adduser –system –group –home /run/nslcd –no-create-home –gecos ‘nslcd name service LDAP connection daemon’ nslcd command. 5.11.0
4182753
When you configure the SPAN port mirror truncate size to a value greater than 4 and less than the supported minimum, NVUE allows the configuration even though there are errors and failures in the mirror session configuration.
The supported values for truncate size are 32 to 4088 for Spectrum 1, 48 to 4088 for Spectrum-2 and Spectrum-3, and 64 to 4088 for Spectrum-4.
To work around this issue, run the echo <supported_value> > /cumulus/switchd/config/mirror/session/1/truncate_size command before you reconfigure mirror sessions with the supported values.
5.8.0-5.11.0
4176931
The nv show platform firmware command results in a Python traceback and takes a long time to complete because the VX image does not support the smartctl utility. 5.11.0
4175695
If all of the neighbors returned in the nv show vrf router bgp neighbor command output have no address-family configuration, you see an internal error when the nested table in the output is being rendered. 5.10.0-5.11.0
4175217
When there is a large number of discontiguous VTEP to VLAN mappings, switchd crashes with a Netlink error similar to the following:

netlink.c:409 CRIT nlroute: nl_cache_mngr_data_ready failed: Kernel reported truncated message
5.10.1-5.11.0
4170628
If you use a bridge name that isn’t br_default, NVUE generates incorrect ptp4l.conf files. 5.10.0-5.11.0
4170604
When you configure EVPN multihoming with more than one ESI bond member, you might see intermediate traffic loss. 5.9.1-5.11.0
4159554
When you configure EVPN multihoming with more than one ESI bond member, you might see intermediate traffic loss. 5.9.1-5.11.0
4154839
When you run certain SDK commands (such as sudo sx_api_port_counter_dump_all.py or sx_api_fdb_dump etc') first as the cumulus user, then with sudo, you see the following error:PermissionError: Errno 13] Permission denied: ‘/tmp/python_err_log.txt’
To resolve this issue, run the rm -rf /tmp/python_err_log.txt command.
5.11.0
4142857
The switch drops PTP packets received with extra ethernet padding and you see syslog [ptp4l.ERR] messages. 5.10.0-5.11.0
4135543
Under certain rare scenarios, the operational status of a switch port interface shows as UP after you administratively configure it to stay down with the nv set interface link status down command. To clear this condition, toggle the admin status on the interface once. 5.11.0
4134447
The journal logs might include the error message ERR kernel: [ 7.453789] usb usb2-port2: connect-debounce failed. This log message has no functionality impact and can be safely ignored. 5.11.0
4134174
If you configure a route map by attaching it to a specific protocol, then you detach it from that protocol, if you then attach the same route map to all protocols, then detach it from all protocols, Cumulus Linux deletes routes from the forwarding table.
To work around this issue, either attach the route map to all protocols or attach the route map to each protocol you want to use. For example, to attach the route map to all protocols, run the nv set vrf router rib fib-filter route-map command. To attach the route map to each protocol you want to use, run the nv set vrf router rib fib-filter protocol route-map command.
5.11.0
4130022
When you configure LDAP authentication, applying NVUE configuration might take a long time if the LDAP server is slow. To avoid this delay, ensure that local is before ldap in the authentication order. 5.11.0
4128952
Cumulus Linux does not support LDAP over IPv6. 5.11.0
4127932
After you run the nv action install system image command or the cl-image-upgrade -u command, if you run the command a second time to upgrade to a different image, the upgrade might fail because there are leftover /var/install/sys mounts. To resolve this issue, either reboot before you retry image upgrade or run the following commands :
cumulus@switch:~$ sudo mount –make-rslave /var/installer/sys
cumulus@switch:~$ sudo umount -R /var/installer/sys
cumulus@switch:~$ sudo umount tmpfs-installer
5.11.0
4124376
The SN3700C-S, SN5400, and SN5600 secure boot switch running Cumulus Linux 5.11.0 boots with shim 15.8 that adds entries to the SBAT revocations to prevent the switch from booting shim 15.7 or earlier (included in Cumulus Linux 5.10 and earlier).
To downgrade a secure boot switch from Cumulus Linux 5.11.0 or to recover a downgraded switch that does not boot, follow the steps in Downgrade a Secure Boot Switch from Cumulus Linux 5.11.0.
5.11.0
4115126
When IPv4 layer 3 switch ports and virtual interfaces flap, switchd might send an ICMP Reply message instead of an ARP request (although no ICMP request was sent). Multiple ICMP Replies might be sent to any of the neighbor IP addresses of that interface. 5.9.2-5.11.0
4105127
Any sFlow configuration changes that require an hsflowd restart are operational only after an initial delay of 60 seconds. 5.11.0
4101560
The nv set vrf router rib fib-filter route-map command only works if you restart FRR after you run the command. To work around this issue, attach the route map to each needed protocol; for example, run the nv set vrf router rib fib-filter protocol route-map command. 5.11.0
4100629
LLDP neighbor changes get reflected in show command outputs only after the tx-interval timer times the tx-hold-multiplier. 5.11.0
4082210
When you change the CPU resource limit with the nv set service control rsyslog resource-limit cpu command, the rsyslog agent does not start. To work around this issue, increase the CPU resource limit, then restart the service manually. 5.11.0
4077921
You cannot use package upgrade to upgrade from Cumulus Linux 5.9.2 to Cumulus Linux 5.10.1. You must install the Cumulus Linux 5.10.1 image. 5.10.1-5.11.0
4047798
Packet distribution based on ECMP hash is not working for VXLAN at TOR switches where it is encapped. To balance traffic between egress ports, you can use lag or ECMP hash. To enable traffic distribution in this use case, lag hashing as well needed to be enabled. 5.10.0-5.11.0
4007590
When you upgrade Cumulus Linux 5.9.1 to Cumulus Linux 5.9.2 or later with package upgrade, the NTP service stops. To restart the NTP service, enable, then restart the service in the VRF in which it was running with the systemctl enable ntpsec@ and systemctl restart ntpsec@ commands. 5.10.0-5.11.0
3985682
On Spectrum-4 switches, multicast flows containing packets smaller than 512 bytes might not reach full line rate. Cumulus Linux supports 512 byte and larger multicast packets. 5.10.0-5.11.0
3966312
When connecting the SN5xxx switch to third party test equipment (such as IXIA) using copper cables at 100GbE, 200GbE, 400GbE, or 800GbE, links do not come up. 5.10.0-5.11.0
3915878
If you configure remote syslog export through a non-default VRF, you might see repeated error logs from the rsyslog process while the switch is booting:
rsyslogd: create UDP socket bound to device failed: No such device [v8.2302.0]rsyslogd: No UDP socket could successfully be initialized, some functionality may be disabled.  [v8.2302.0]

The logs occur because the rsyslog service starts before the networking service creates the configured VRF for syslog export. There is no functional impact with this issue.
5.9.0-5.11.0
3879809
What Just Happened (WJH) does not work on Spectrum-4 switches. 5.9.0-5.11.0
3879717
Running snmpwalk on the switch with the management IP address does not work. To work around this issue, use the localhost option (snmpwalk -v 2c -c public28 localhost 1.3.6.1.2.1.14) or create a control plane ACL whitelist rule. 5.10.0-5.11.0
3878394
When ZTP runs a script that contains wget, ZTP fails and you see a message similar to the following:
ZTP: ZTP DHCP: Unexpected error: ‘ascii’ codec can’t decode byte 0xe2 in position 181: ordinal not in range(128)ZTP: Script returned failure 

To work around this issue, use the -q option with wget.
5.9.0-5.11.0
3877516
When you connect two NVIDIA switches and configure 400G speed in force mode, links don’t come up.
To work around this issue, make sure auto negotiation is always on when connecting NVIDIA to NVIDIA in PAM4.
5.9.0-5.11.0
3875373
When you run the nv config apply empty command, NVUE removes the cumulus user. If you are logged in as the cumulus user when you run the nv config apply empty command, the command fails. 5.9.0-5.11.0
3861745
On UEFI hardware (where the /sys/firmware/efi directory exists), using the update-grub program might generate a /boot/grub/grub.cfg that is incorrect for booting ONIE if the ONIE option is selected on the console while booting. To work around this issue, run mount LABEL=“EFI System” /boot/efi before using update-grub. 5.9.0-5.11.0
3855796
When configuring a Unicast Master Table for clients, the server addresses must be reachable and the route to the destination must exist. The unicast table can have one directly-connected port for a client. This restriction is only for directly connected ports and doesn’t apply to Unicast Servers on other devices or switches. 5.9.0-5.11.0
3847439
In rare cases on the Spectrum 1 switch where a dual connected host transmits all traffic flows to only one switch in a connected MLAG pair and the host changes behavior to hash all flows to the other MLAG switch, there might be traffic loss if the MAC FDB entry on the original switch ages out. 5.9.0-5.11.0
3844670
When you configure TACACS with NVUE or merge in an NVUE configuration file including TACACS configuration with the nv config patch command, you see an unrecoverable error when running additional NVUE commands. To work around this issue, restart the NVUE service with the systemctl restart nvued.service command. 5.9.0-5.11.0
3835635
When adaptive routing is enabled, traffic for non adaptive routing enabled ports and non adaptive routing ECMPs might be routed over all ports in ECMP. Avoid using regular ECMPs with adaptive routing enabled on the switch. 5.9.0-5.11.0
3819945
When you connect an NVIDIA SN4410, SN4700, or SN5600 switch to any Spectrum 1, Spectrum-2, or Spectrum-3 peer switch (with four lanes) using a 4x breakout configuration and the default lanes per port setting, links do not come up. To work around this issue, provide the lanes per port configuration shown below:
cumulus@switch:~$ nv set interface  link breakout 4x lanes-per-port 1
5.9.0-5.11.0
3818545
The terminal monitoring software SecureCRT has a known issue when running on both Windows and Mac systems where it gets “stuck” when monitoring the serial port of the switch as Cumulus Linux boots up. When this occurs, the serial port stops as shown below and SecureCRT is unable to receive any more serial data from the switch (it is able to transmit).
Mounting dev-hugepages.mount - Huge Pages File System..
Mounting dev-mqueue.mount
5.9.0-5.11.0
3774274
When you manually configure the /etc/cumulus/datapath/qos/qos_features.conf file without applying the QoS configuration with NVUE, running the nv config apply empty command later does not clean up the QoS configuration. If the QoS configuration includes breakout ports, the nv config apply empty command fails due to a switchd reload trigger failure. To work around this issue, clean up the configuration manually in the /etc/cumulus/datapath/qos/qos_features.conf, then run the nv config apply empty command. 5.8.0-5.11.0
3773177
When you try to upgrade a switch from Cumulus Linux 5.5 or earlier to 5.8.0 or later with package upgrade, you see errors for expired GPG keys that prevent you from upgrading. To work around this issue, install the new keys with the following commands, then upgrade the switch.
cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/c/cumulus-archive-keyring/cumulus-archive-keyring_4-cl5.6.0u5_all.deb
cumulus@switch:~$ sudo apt install ./cumulus-archive-keyring_4-cl5.6.0u5_all.deb
cumulus@switch:~$ sudo apt update
cumulus@switch:~$ sudo apt upgrade
4.0.0-4.4.5, 5.0.0-5.11.0
3771168
When you perform an ISSU upgrade on a Spectrum 1 switch, the switchd service might crash. 5.8.0-5.11.0
3677533
Due to resource constraints on the Spectrum 1 switch, staticd performance drops and takes longer to read static routes compared to the time BGP takes to complete a graceful restart and advertise routes and EOR to its helpers. As a result, static routes are advertised after the EOR is sent to graceful restart helpers, which delete the stale static routes and relearn them after receiving the EOR from the restarting node. Temporary traffic loss might occur. 5.7.0-5.11.0
3655681
When you disable, then enable STP auto-edge on a port, the port might not transition to the operational edge even though the port does not receive bpdus. To work around this issue, configure the port as an admin-edge port. 5.7.0-5.11.0
3637444
Applying an inbound control plane ACL on the eth0 management interface does not take effect. To work around this issue, apply the ACL on the mgmt interface; for example, nv set interface mgmt acl inbound control-plane. 5.7.0-5.11.0
3591918
The nv action disconnect system aaa user command does not clear all the open sessions. To work around this issue, run the command as many times as the number of sessions to clear all the sessions. 5.6.0-5.11.0
3587393
If you use the NVIDIA SN5600 (Spectrum-4) switch with Ixia test equipment, you might experience delayed link up due to intermittent link flaps.
To work around this issue when using copper cables:
  • Use Ixia IxOS version 9.37 with HF002156, or version 9.39 or later.
  • Use the DAC cable on ports 10 through 50.
  • Use NVIDIA cables with the recommended firmware revision.
  • Configure AN on the Cumulus Linux switch and AN/LT on Ixia.

To work around this issue when using fiber cables:
  • Configure 800g/Force.
  • Use the recommended NVIDIA optical adapters.
5.6.0-5.11.0
3556762
On rare occasions, SPT switchover might not happen cleanly in PIM resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout. 5.5.0-5.11.0
3540510
400Gx8 ports only support traffic line rate with packets that are larger than 172 bytes. 5.6.0-5.11.0
3538321
In rare cases, an STP topology change on PTP over a VLAN can result in the switch losing the slave state and one of the ports might remain in an uncalibrated state. To work around this issue, toggle the port that is in the uncalibrated state up and down so that one of the ports is selected as the slave. 5.6.0-5.11.0
3497622
When you remove PSUs, then plug them back in, you might experience traffic loss and some ports might be in a down state. 5.6.0-5.11.0
3472163
On a switch with the Spectrum-4 ASIC, packets that are smaller than 256 bytes are not included in multicast flows. Multicast flows support packets that are 256 bytes or larger. 5.6.0-5.11.0
3470940
On a switch with the Spectrum-4 ASIC, packets that are smaller than 256 bytes are not included in multicast flows. Multicast flows support packets that are 256 bytes or larger. 5.6.0-5.11.0
3444490
Migration from ONYX to Cumulus Linux is supported and tested with ONYX version 3.10.4302 GA only. 5.6.0-5.11.0
3442569
When trying to access the NVUE API, user accounts authenticated with a newly-configured external service, such as TACACS, RADIUS, or LDAP, receive a 401 forbidden error. To work around this issue, after enabling a new authentication service, make sure to restart both nginx.service and nvued.service to begin authenticating users against the new authentication service. 5.5.0-5.11.0
3430430
When you configure PTP on 50G ports, the offset correction might be higher, which can affect the time synchronization of the node. To work around this issue, configure PTP on 100G ports, or on 10G or 1G ports with PTP shaper enabled. 5.5.0-5.11.0
3424967
sudo for TACACS+ users with privilege level 15 does not work when reaching the TACACS+ server through the default VRF. To work around this issue, specify the interface name that the default VRF uses in the vrf= setting of the /etc/tacplus_servers file or run the NVUE nv set system aaa tacacs vrf command. If you don’t run either command, a TACACS+ user with privilege level 15 can run vrf task exec default sudo … to execute the sudo command. 5.0.0-5.11.0
3420056
The ADVA 5401 SFP module with hardware revision 5.01 does not come up at layer 1 when you use 10G QSA adaptors. To work around this issue, use 25G QSA adaptors. 4.4.0-4.4.5, 5.0.0-5.11.0
3362113
If you restore an NVUE startup.yaml file or run the nv config patch command after an upgrade that includes breakout ports with QoS configuration, the NVUE configuration fails to apply. Subsequent attempts to run nv config apply fail with a message similar to Invalid config [rev_id: 11] qos config is not supported on the following invalid interface: swp1s0. Supported on swp and bond interface types. To work around this issue, run nv unset on the configured QoS settings, then apply the breakout port configuration before you configure QoS. Alternatively, you can remove the QoS configuration from the yaml file and patch it separately after applying the breakout configuration. 5.4.0-5.11.0
3347538
When connecting NVIDIA-to-NVIDIA in PAM4, you must enable auto-negotiation. 5.4.0-5.11.0
3341214
If you use the NVUE REST API to configure a local user with a hashed password, the user cannot log in and the /etc/nvue.d/startup.yaml file shows the password as plain text. 5.4.0-5.11.0
3329518
When using TACACS+, if the /etc/nsswitch.conf file specifies passwd: files tacplus (files is listed before tacplus), a user that is present in both the local /etc/passwd file and the TACACS+ server cannot log into the switch. NVIDIA recommends that when using TACACS+, you list tacplus before files in /etc/nsswitch.conf. When using NVUE, ensure that tacacs has priority over local. 5.4.0-5.11.0
3327477
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. 3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.11.0
3326659
If you have a large number of MAC addresses, they do not age out at the MAC ageing timeout value configured on the switch. It might take up to 30 seconds more for the MAC addresses to age out and be deleted from the hardware. To work around this issue, wait for the ageing timeout value plus 30 seconds. 5.4.0-5.11.0
3253218
Auto-negotiation isn’t supported on Spectrum-2 and Spectrum-3 switches using the 1G SFP-T module; FORCE 1G is configured instead. 5.4.0-5.11.0
3241567
When you apply switch configuration for the first time on a freshly booted switch and you run the nv config apply command after setting the hostname with nv set system hostname, you might see the error message Failed to start Hostname Service. To work around this issue, run the nv config apply command a second time. 5.3.0-5.11.0
3226506
The l1-show eth0 command does not show port information and is not supported in this release. 5.3.0-5.11.0
3225117
Occasionally, packet losses might occur on 25G ports when link is raised without FEC. 5.4.0-5.11.0
3172504
When you connect the NVIDIA SN4600C switch to a Spectrum 1 or Spectrum-3 switch with a 40GbE passive copper cable (Part Number: MC2210126-005) on edge ports 1-4 and 61-64, there is an Effective BER of 1E-12 in PHY. 5.2.0-5.11.0
3147782
You cannot use NVUE to configure an SNMP view to include a subtree beginning with a period. For example:
cumulus@switch:~$ nv set service snmp-server viewname cumulusOnly included .1.3.6.1.4.1.40310Error: GET /nvue_v1/service/snmp-server/viewname/cumulusOnly/included?pointers=%5B%22%2Fparameters%22%2C+%22%2Fpatch%2FrequestBody%2Fcontent%2Fapplication~1json%2Fschema%22%2C+%22%2Fpatch%2Fparameters%22%2C+%22%2Fpatch%2Fresponses%2F200%2Flinks%22%5D responded with 404 NOT FOUND
To work around this issue, reference the OID without the preceding period ( . ) in the command.
5.3.0-5.11.0
3145869
On a Spectrum-3 switch, the PTP offset in 10GbE changes between +-27. The average offset is around 7. 5.2.0-5.11.0
3135952
PAM4 split cables (such as 2x100G, 4x100G, and 4x50G) do not work with a forced speed setting (when auto-negotiation is off) as the default speed enabled is for NRZ mode (such as 100G_4X). To work around this issue, set the appropriate lanes for forced speed (with auto-negotation off) with the ethtool -s swpX speed <port_speed> autoneg off lanes <no_of_lanes> command. For example:
cumulus@switch:~$ sudo ethtool -s swp1 speed 100000 autoneg off lanes 2
5.2.0-5.11.0
3122301
On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. 5.2.0-5.11.0
3115242
When you configure two VNIs in the same VLAN, ifupdown2 shows a vlan added to two or more VXLANS warning, which is only issued after the VNI is already added to the bridge. This leaves the new VNI in the PVID even if there is already an existing VNI configured in that PVID. 5.1.0-5.11.0
3103821
On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. 5.2.0-5.11.0
3084476
After you disable traffic shaping in the /etc/cumulus/datapath/qos/qos_features.conf file, the default QOS traffic shaping configuration does not restore. To work around this issue, restart switchd. 4.4.3, 5.0.0-5.11.0 4.4.4-4.4.5
3084027
Under a high load, you might see ingress drop counters increase. The drops are classified as HwIfInDiscards in ethtool and shown as ingress_general in hardware. 4.3.0-4.4.5, 5.0.0-5.11.0
3071652
On rare occasions, after you reboot or restart switchd on a Spectrum 1 switch, any 25G connections with Direct Attach Copper (DAC) cables that connect from the switch to a non-NVIDIA device might flap continuously. To work around this issue, bring the affected link administratively down for a few seconds on the non-NVIDIA device, then bring the link back up. 4.4.4-4.4.5, 5.1.0-5.11.0
3061656
When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. 5.1.0-5.11.0
3053094
When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. 5.1.0-5.11.0
2972540
With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts. 5.0.0-5.11.0
2964279
When a VNI flaps, an incorrect list of layer 2 VNIs are associated with a layer 3 VNI. The NCLU net show evpn vni detail command output shows duplicate layer 2 VNIs under a layer 3 VNI. 3.7.15, 4.4.2-4.4.5, 5.0.0-5.11.0 3.7.16
2951110
The net show time ntp servers command does not show any output with the management VRF. 3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.11.0
2904450
When you run the ethtool -m or the l1-show command, the 400G interface optical values do not show. 4.4.0-4.4.5, 5.0.0-5.11.0
2891255
CVE-2021-39925: Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file.
Vulnerable: <= 2.6.20-0+deb10u1
Fixed: 2.6.20-0+deb10u2
4.0.0-4.4.1, 5.0.0-5.11.0 4.4.2-4.4.5
2890681
CVE-2021-42771: relative path traversal in Babel, a set of tools for internationalising Python applications, could result in the execution of arbitrary code
Vulnerable: 2.6.0+dfsg.1-1Fixed: 2.6.0+dfsg.1-1+deb10u1
4.0.0-4.4.1, 5.0.0-5.11.0 4.4.2-4.4.5
2885305
Certain Murata PSU attributes show intermittently in the sensors command output. To work around this issue, upgrade to the latest PSU firmware on Murata. 5.0.0-5.11.0
2867042
When connecting the NVIDIA SN4600 switch to another NVIDIA Spectrum switch, you must use auto-negotiation mode (not force mode); otherwise the switch might use the wrong Tx configuration. 5.0.0-5.11.0
2823307
Cumuls Linux does not support a bond with more than 64 ports. Any configuration with more than 64 ports in a bond changes all ports to down when you apply the configuration. 5.0.0-5.11.0
2736108
When you change the VRRP advertisement interval on the master, the master advertisement interval field in the show vrrp command output does not show the updated value. 4.4.0-4.4.5, 5.0.0-5.11.0
2684925
The NVUE nv show vrf default router bgp peer command produces a 404 not found error. 4.4.0-4.4.5, 5.0.0-5.11.0
2671652
In VXLAN routing environments, you might experience sub-optimal route convergence delays (longer than five seconds) when a prefix transitions to a new ECMP next-hop group. This condition might occur when a VTEP loses ECMP routes through all uplink peerings, then installs the routes through a different path, such as an MLAG peerlink. 4.4.0-4.4.5, 5.5.0-5.11.0

Fixed Issues in 5.11.0

Issue ID Description Affects
4137492
Accessing NVIDIA Spectrum-4 SPICE from multiple applications to the same path in parallel might cause a kernel crash. 5.10.1
4135919
You might experience a memory leak in ospfd when processing next hops due to network changes. 5.9.1-5.10.1
4130139
If the LDAP server becomes unreachable while an LDAP user is logged on, NVUE nv set and nv show commands result in traceback messages.
4129344
When you create an ACL rule that matches TCP state and more than seven TCP or UDP source or destination ports, the rule does not get framed properly and is rejected by the kernel.
To work around this issue, create another rule number when the number of ports you want to match is more than seven.
5.9.1-5.10.1
4127636
Multicast traffic continues to egress an interface that leaves the group. Logs and multicast data show that the IGMP group is deleted but the OIF is still listed. 5.10.0-5.10.1
4124831
When Per-VLAN Rapid Spanning Tree (PVRST) mode is enabled, bonds with LACP bypass discard ingress DHCP packets. 5.9.1-5.10.1
4119621
When you set the SNMP server listening address to listen on all IPv4 and IPv6 addresses in a VRF with the nv set service snmp-server listening-address all vrf and nv set service snmp-server listening-address all-v6 vrf commands,SNMP requests over IPv6 addresses do not work. 5.8.0-5.10.1
4111688
The ethtool -m command output for certain QSFP-DD and OSFP optical modules does not report the alarm status of the various channels correctly. This is an issue with ethtool that has been fixed and upstreamed.
4102992
When you use the NVUE nv set bridge domain stp priority command to configure the STP priority on two bridges, the STP priority on the second bridge does not apply.
To work around this issue, configure an NVUE snippet for the second bridge and apply it to the switch; for example:
Create the vlan-aware_bridge_snippet.yaml file and add the following:
- set:
system:
config:
snippet:
ifupdown2_eni:
bridge2: |mstpctl-treeprio 8192

Save the file, run the nv config patch vlan-aware_bridge_snippet.yaml command, then the nv config apply command.
5.9.1-5.10.1
4101808
When the SNMP service is busy for approximately more than a minute, the applications using net-snmp APIs to support their MIBs (such as FRR) become blocked. 5.9.0-5.10.1
4096505
In an EVPN configuration, when you use NVUE to configure a new host bond and an multihoming ESI at the same time, the Split-Horizon preventive traffic class rule is not programmed in the egress direction. To work around this issue, configure the host bond and apply the configuration, then configure the EVPN multihoming ESI on the host bonds and apply the configuration in a separate step. 5.9.1-5.10.1
4089469
When you apply interface configuration at the same time as VRF based services (such as the DHCP service for a VRF), the VRF based service does not become fully operational because the service is not receiving protocol packets.
To work around this issue, first apply the interface configuration, then apply the configuration for the VRF based service.
4087368
On the NVIDIA SN2201 switch, the nv show platform firmware SSD command shows the error The requested item does not exist and the nv show platform firmware command does not show SSD details.
4086136
If a Cumulus Linux 5.9.1 switch has an nv set interface lldp application-tlv configuration with an empty value, when you upgrade to Cumulus Linux 5.10, NVUE cannot apply the configuration and shows an Invalid config message. 5.10.0-5.10.1
4081784
If you configure an inbound route policy that drops prefixes, running the vtysh show bgp vrf neighbours received-routes command might crash the BGP service.
Avoid running the vtysh show bgp vrf neighbours received-routes command if you configure a drop inbound route policy.
5.9.1-5.10.1
4072165
When you add a VLAN to a bridge member port, VXLAN traffic might be impacted for few seconds. 5.7.0-5.10.1
4066219
Some STP interfaces might remain in a blocking state when there are large numbers of dis-contiguous VLANs enabled on a port. 5.8.0-5.10.1
4063273
Low power Intel SATA controllers experience issues when using the mobile low power chipset LPM policy. This can cause the SSD to become read only. 5.8.0-5.10.1
4061534
When you remove a secondary OTLP collector, there is a telemetry spike and existing connections with OTLP exporters reset. When new connections with the OTLP collector re-establish, the server experiences a high CPU and memory leak, which can bring down the telemetry collection service. 5.10.0-5.10.1
4050835
The NVUE Service fails to start after an upgrade from Cumulus Linux 5.9 to Cumulus Linux 5.10 because of a corrupted database. 5.10.0-5.10.1
4050801
When configuring telemetry for interface statistics with ranges or lists, the lists and ranges do not expand correctly in the configuration and the configuration is rejected. Configuration example:
cumulus@leaf01:~$ nv set system telemetry interface-stats ingress-buffer priority-group 1-6
cumulus@leaf01:~$ nv set system telemetry interface-stats egress-buffer traffic-class 0,3,6

You see the following log errors:
interface_stats: [ERROR] interface_stats_collector.py:_parse_conf_file:201 — Configured ingress-priority-group 0-6 is not an integer
interface_stats: [ERROR] interface_stats_collector.py:_parse_conf_file:201 — Configured egress-traffic-class 0,3,6 is not an integer
5.10.0-5.10.1
4037315
NVUE fails to enforce the password length limitation of 512 characters or fewer. 5.10.0-5.10.1
4037224
ASIC monitoring histogram collection might not work because of a crash in the asic-monitor service. To work around this issue, see the Release Considerations section of the What’s New. 5.10.0
4034329
After network churn, the watchfrr process might restart FRR because zebra is unresponsive. 5.9.1-5.10.0
4023318
If you run nv set commands after you perform an upgrade but before a reboot, NVUE creates a revision based off the pre-upgrade version. After reboot, the revision contains pre-upgrade data that might cause it to fail during config apply. To work around this issue, detach the stale revision after upgrade with the nv config detach command. 5.10.0-5.10.1
4022906
If you use NVUE to configure a bond, apply a port mirror on the bond, then run the nv config apply command, the validation fails.
To work around this issue, configure the bond with a separate nv config apply command before you configure the port mirror on the bond.
5.10.0-5.10.1
4016216
If a ZTP script includes a directive to reboot, the reboot might stop the running ZTP process before it is able to disable itself from running again. As a result, the ZTP process starts again when the system comes back up. To work around this issue, run shutdown -r +1 to schedule a reboot after one minute so that the ZTP process can successfully complete disabling the ztp.service systemd service. 5.10.0
4004898
When you configure the SNMP server listening address to a VRF that has no interfaces, snmp.service fails.
To recover from the failure, set the SNMP server listening address back to the VRF that has interfaces. If you really want to move the SNMP server to the VRF with no interfaces, assign an interface to the VRF and move the SNMP server to the VRF.
5.10.0-5.10.1
3990135
If there are multiple relay switches in the path reaching the DHCP server, DHCP packets are duplicated at each transit relay switch and the server receives duplicate packets. 5.9.1-5.10.1
3928905
The nv show interface commands show RX and TX Power values from the wrong lanes on breakout ports. 5.8.0-5.9.1, 5.10.0-5.10.1
3878699
In an EVPN multihoming configuration, when the VXLAN device associated with a layer 2 VNI flaps, there is a route entry in the tenant VRF associated with the locally learned host. 5.9.0-5.10.1
3452681
When you run the NVUE nv show system aaa tacacs authorization commands to show per command authorization for a specific TACACS+ user privilege level, you see an error message similar to Error: GET /nvue_v1/system/aaa/tacacs/authorization/1?rev=operational responded with 404 NOT FOUND. 5.5.0-5.10.1