CVE-2026-102080: CWE-413 Improper Resource Locking in Juniper Networks Junos OS

This vulnerability (CWE-413) in Juniper Networks Junos OS affects the clock synchronization daemon (clksyncd) on MX Series devices equipped with SCBE3. When a SyncE or PTP upstream node sends a malformed message, a false 19.44MHz alarm is generated on the master route engine, causing persistent route engine switchovers and clksyncd process crashes. The vulnerability arises from improper resource locking leading to a race condition. It can be exploited by an unauthenticated, logically adjacent attacker to cause denial-of-service. Affected versions include all Junos OS releases before 23.2R2-S7.7, certain 23.4, 24.2, 24.4, 25.2, and 25.4 versions prior to their respective fixed releases.

The vulnerability allows an unauthenticated attacker with logical adjacency to cause denial-of-service on MX Series devices by triggering persistent route engine switchovers and crashes of the clksyncd process. There is no impact on confidentiality or integrity, only availability is affected.

A fix is available in Junos OS versions 23.2R2-S7.7 and later for the 23.2 release train, 23.4R2-S8.13 and later for 23.4, 24.2R2-S5.5 and later for 24.2, 24.4R2-S4 and later for 24.4, 25.2R2-S1 and later for 25.2, and 25.4R1-S2 and later for 25.4. Users should upgrade to these fixed versions to remediate the vulnerability. No other mitigation or workaround is indicated.