What's New

This document supports the Cumulus Linux 5.19 release, and lists new features and enhancements.

• For a list of open and fixed issues in Cumulus Linux 5.19, see the Cumulus Linux 5.19 Release Notes.
• To upgrade to Cumulus Linux 5.19, first check the Release Considerations below, then follow the steps in Upgrading Cumulus Linux.

What’s New in Cumulus Linux 5.19.0

Cumulus Linux 5.19.0 includes new features and improvements, provides bug fixes, and includes a fix for CVE-2026-98432.

New Features and Enhancements

• FRR upgrade to 10.6.0
• Prevent re-export of VRF-leaked EVPN routes
• Class E (240.0.0.0/4) address space support
• Disjoined multiplane support for EVPN unreachability with 802.1X dynamic VRF assignment
• Layer 3 VXLAN device mode is generally available
• Multi ASIC fast boot support (Beta)
• BFD offload to switch firmware
• Control plane punt classifier drop counters for drops caused by link failures or missing next hops
• The cl-support file captures the SSD internal NAND debug log on a switch with a Virtium NVMe SSD
• Patch uninstall returns the switch to the patch installed underneath, and a new command reclaims the space held by superseded patches
• PFC watchdog detection parameters that distinguish a real deadlock from steady-state congestion
• Pipeline flush to limit how long the switch waits on a stalled ASIC pipeline on Spectrum-4 and Spectrum-5 switches
• Security configuration report that collects the security configuration of the switch and checks each value against the reference values for the platform
• Back-to-sender notification on congestion tail drop on Spectrum-6 switches
• Back-to-sender notification when an MRC egress link fails
• Step time estimation for AI training workloads
• Dedicated service port ingress buffers on Spectrum-6 switches
• Configurable source address for DNS queries, so that queries leave the switch from a stable loopback identity
• Optimized image upgrade options to cancel a pending boot-next and to declare additional files to carry forward to the upgraded partition. Optimized image upgrade no longer copies all of the /etc directory.
• Full resource mode ISSU (Beta) on Spectrum-4 and later switches, which keeps 100 percent of forwarding table capacity during the upgrade
• Trimmed packet sent and dropped counters at the global, port, and traffic class level on Spectrum-6 switches
• NVUE
  • Passwordless sudo access by default for members of the sudo group, and RBAC os-command allow-lists for granular passwordless access to specific commands (Beta)
  • Switch power off command
  • Clear a stale IPv6 ND prefix on demand
  • Default IPv6 ND prefix lifetimes for an interface
  • Manage staged platform firmware files, automatic updates, and firmware source for each component
  • Show and install transceiver firmware
  • IPv6-only unnumbered peering command
  • Resilient hashing commands
  • nv config apply command improvements to prevent latency and timeout during FRR configuration changes
  • Suppress ZTP console messages
  • Configure the file descriptor limit for the FRR routing daemons
  • Show the physical connector for a port
  • Decoded transceiver Ethernet compliance codes
• Telemetry
  • gNMI component type and name for platform components
  • WJH events, as OTEL log records, and WJH metrics for OTEL
  • gNMI and OTEL metrics for unreachability AFI SAFI
  • OTEL metrics for AAA RADIUS login authentication
  • Microburst histogram with per-port burst scoring
  • Configurable source address for gNMI dial-out connections
  • gNMI and OTEL metrics for trimmed packet sent and dropped counters on Spectrum-6 switches
  • Updated gNMI xPaths for packet trimming counters
  • gNMI and OTEL metrics for back-to-sender notification on link down on Spectrum-6 switches
  • gNMI and OTEL metrics for control plane punt classifier drop counters

Release Considerations

Before you upgrade to Cumulus Linux 5.19, review the following considerations.

Upgrade Requirements

You can use optimized image upgrade and package upgrade to upgrade the switch to Cumulus Linux 5.19 from the following releases. Package upgrade supports ISSU (warm boot) for the 5.17.0 and 5.18 upgrade paths only.

• 5.16.1 through 5.16.8 (cold boot only; ISSU is not supported)
• 5.17.0
• 5.18.0, 5.18.1, 5.18.2, 5.18.3

To upgrade to Cumulus Linux 5.19 from a release that does not support package upgrade or optimized image upgrade, you can install an image with ONIE.

For a list of the earliest Cumulus Linux releases supported for each switch model, refer to this knowledge base article.

Spectrum-6 BMC Requirements

Linux Configuration Files Overwritten

If you use Linux commands to configure the switch, read the following information before you upgrade to Cumulus Linux 5.19.

NVUE includes a default startup.yaml file. In addition, NVUE enables configuration auto save by default. As a result, NVUE overwrites any manual changes to Linux configuration files on the switch when the switch reboots after upgrade, or you change the cumulus user account password with the Linux passwd command.

To prevent Cumulus Linux from overwriting manual changes to the Linux configuration files when the switch reboots or when changing the cumulus user account password with the passwd command, follow the steps below before you upgrade to 5.19 or after a new binary image installation:

1. Disable NVUE auto save:

cumulus@switch:~$ nv set system config auto-save state disabled
cumulus@switch:~$ nv config apply
cumulus@switch:~$ nv config save

2. Delete the /etc/nvue.d/startup.yaml file:

   cumulus@switch:~$ sudo rm -rf /etc/nvue.d/startup.yaml
   

3. Add the PASSWORD_NVUE_SYNC=no line to the /etc/default/nvued file:

   cumulus@switch:~$ sudo nano /etc/default/nvued
   PASSWORD_NVUE_SYNC=no
   

DHCP Lease with the host-name Option

When a Cumulus Linux switch with NVUE enabled receives a DHCP lease containing the host-name option, it ignores the received hostname and does not apply it. For details, see this knowledge base article.

NVUE Commands After Upgrade

After you upgrade to Cumulus Linux, running NVUE configuration commands might override configuration for features that are now configurable with NVUE and removes configuration you added manually to files or with automation tools like Ansible, Chef, or Puppet. To keep your configuration, you can do one of the following:

• Update your automation tools to use NVUE.
• Configure NVUE to ignore certain underlying Linux files when applying configuration changes.
• Use Linux and FRR (vtysh) commands instead of NVUE for all switch configuration.

Show global BGP Unreachability Routes Command Change

In Cumulus Linux 5.19 and later, running the nv show vrf <vrf-id> router bgp address-family <address-family>-unreachability route -o json command is now equivalent to running the vtysh show bgp vrf <vrf-id> ipv6 unreachability json brief command. Therefore, certain fields, such as path details and reporter AS, no longer show. To show a more detailed view, run the nv show vrf <vrf-id> router bgp address-family <address-family>-unreachability route <prefix> -o json command.

BFD Offload Configuration and Show Output

Cumulus Linux 5.19 replaces the BFD offload option with an offload mode that selects where BFD packet processing runs; see BFD Offload.

• Cumulus Linux 5.19 introduces the nv set router bfd offload-mode <control-plane|kernel|hardware> command, which NVIDIA recommends you run to configure BFD offload. Cumulus Linux still supports the nv set router bfd offload enabled and nv set router bfd offload disabled commands as legacy configuration, and NVIDIA plans to remove it in a future release. When you upgrade, Cumulus Linux keeps an existing offload setting unchanged; offload enabled is the same as offload-mode kernel and offload disabled is the same as offload-mode control-plane. See Upgrade Notes.
• The offload field for each peer now reports the engine carrying the session. In nv show vrf <vrf-id> router bfd peers output, the Offloaded column shows kernel, hardware, or control-plane; in vtysh and JSON output, offload-status shows the same three values. In Cumulus Linux 5.18 and earlier, this field shows only offloaded or control-plane. Update any automation or monitoring that matches on the string offloaded.

RIB-to-FIB Filter Protocol Values

Cumulus Linux 5.19 removes connected, kernel, and table as valid values for <import-protocol-id> in the nv set vrf <vrf-id> router rib <address-family> fib-filter protocol <import-protocol-id> route-map <route-map-id> command; see Apply a Route Map.

• If your configuration filters RIB-to-FIB routes from one of these three protocols, nv config apply rejects it after you upgrade. Update any such configuration before you upgrade.
• Remaining valid values are bgp, ospf, static, rip, sharp, isis, ospf6, and ripng.

PIM and MSDP vtysh Commands

Cumulus Linux 5.19 upgrades FRR, which moves the vtysh commands that configure PIM and MSDP for a routing instance into a router pim [vrf <vrf-name>] block and drops the ip prefix; see Protocol Independent Multicast - PIM.

• ip pim rp, ip pim ssm prefix-list, ip pim ecmp, ip pim spt-switchover, the ip pim timer commands, and the ip msdp mesh-group commands move under router pim and lose the ip prefix. For example, switch(config)# ip pim rp 10.10.10.101 becomes switch(config)# router pim followed by switch(config-pim)# rp 10.10.10.101.
• ip pim spt-switchover infinity becomes spt-switchover infinity-and-beyond.
• Per-VRF PIM settings move out of the vrf <vrf-name> block into a separate top-level router pim vrf <vrf-name> block.
• Interface-level commands, such as ip pim, ip pim hello, ip pim bfd, ip pim use-source, ip pim allow-rp, ip pim active-active, ip multicast boundary oil, and all ip igmp commands, are unchanged. All NVUE commands are unchanged.
• Check the /etc/frr/frr.conf file and any automation that configures PIM or MSDP through vtysh before you upgrade.

Class E Address Space Support

FRR now treats the IPv4 240.0.0.0/4 (Class E) range as valid unicast address space on every switch running Cumulus Linux 5.19, whether or not you allow Class E as routable address space. A Class E interface address and its connected route can appear in nv show interface output and the routing table even if you never run the nv set router allow-reserved-range class-e command.

• The FRR allow-reserved-ranges command no longer includes Class E; it now covers only 0.0.0.0/8 and 127.0.0.0/8. If you previously set this command only to use Class E, you no longer need to.
• Until you allow Class E, Cumulus Linux still blocks Class E traffic, but the control-plane packet filter drops it instead of the ASIC. If you monitor hardware drop counters for Class E source addresses, you see this difference after you upgrade.

For more information, see Class E Address Space Support.

Multiple IPv6 numbered eBGP Sessions Between the Same Pair of Switches

In Cumulus 5.18 and earlier, when you configure multiple parallel IPv6 numbered eBGP sessions between the same pair of switches, you need to configure update-source separately for each session on both switches using the local IPv6 address assigned to the link for that neighbor. If you do not configure this setting, some sessions might remain in an idle state during simultaneous link or session bringup. This issue no longer occurs in Cumulus Linux 5.19 and later and you no longer need to configure this setting.

WJH Drop Filter Limits

Cumulus Linux now limits WJH drop filters: you can configure a maximum of 128 drop filters in total across all channels, and all drop filters together can have a maximum of 1024 entries (IP addresses, drop reasons, and severities). If the startup configuration exceeds a limit when you upgrade, Cumulus Linux keeps it; you can reduce the number of drop filters or entries, but you cannot increase a number that is above its limit. Refer to Filter Traffic Drops.

Link Tracking Customized Files

During optimized image upgrade to Cumulus Linux 5.19, the upgrade process does not carry forward customized /etc/ifplugd/action.d/ifupdown and /etc/default/ifplugd files by default. The switch uses the default configurations from the new image instead.

To preserve customizations, add a carry-forward entry for each required file in a configuration file under /etc/cumulus/upgrade-carry-forward.d/ on the partition from which you are upgrading. For example:

cumulus@switch:~$ sudo nano /etc/cumulus/upgrade-carry-forward.d/custom.conf
# Customized Files
carry-forward /etc/ifplugd/ifplugd.action
carry-forward /etc/default/ifplugd

Refer to Carry Forward Additional Files.

Cumulus VX

NVIDIA no longer releases Cumulus VX as a standalone image. To simulate a Cumulus Linux switch, use NVIDIA DSX Air.