Description

The following errors occurred followed by interfaces going down (full logs will be added to case):

 

Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3-BAD_PAGE_FAULT: pid 77652 (fxpc), uid 0: pc 0x80cd988 got a write fault at 0xdeadbf13, x86 fault flags = 0x6
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: Trapframe Register Dump:
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: eax: deadbeef ecx: deadbeef edx: 2677c0c8 ebx: 26993504
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: esp: 26993460 ebp: 26993488 esi: 2677c0c8 edi: 26993504
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: eip: 080cd988 eflags: 00010282
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: cs: 0033 ss: 003b ds: 2699003b es: 003b
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: fs: 003b trapno: 0000000c err: 00000006
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: Page table info for PC address 0x80cd988: PDE = 0x2b040067, PTE = 15c77425
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: Dumping 16 bytes starting at PC address 0x80cd988:
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: 89 41 24 8b 42 24 89 08 c7 42 14 00 00 00 00 c7
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3-BAD_PAGE_FAULT: pid 77652 (fxpc), uid 0: pc 0x80cd988 got a write fault at 0xdeadbf13, x86 fault flags = 0x6
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: Trapframe Register Dump:
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: eax: deadbeef ecx: deadbeef edx: 2677c0c8 ebx: 26993504
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: esp: 26993460 ebp: 26993488 esi: 2677c0c8 edi: 26993504
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: eip: 080cd988 eflags: 00010282
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: cs: 0033 ss: 003b ds: 2699003b es: 003b
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: fs: 003b trapno: 0000000c err: 00000006
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: Page table info for PC address 0x80cd988: PDE = 0x2b040067, PTE = 15c77425
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: Dumping 16 bytes starting at PC address 0x80cd988:
Jan 29 01:49:35.529 QFX5100 /kernel: %KERN-3: 89 41 24 8b 42 24 89 08 c7 42 14 00 00 00 00 c7
Jan 29 01:49:49.354 QFX5100 /kernel: %KERN-4: Percentage memory available(15)less than threshold(20 %)- 27

 

Symptoms

  • PFE will reboot only while the RE will continue without rebooting:
                                           
    root@QFX5100> show chassis fpc detail

Slot 0 information:
  State                               Online
  Temperature                      33 degrees C / 91 degrees F
  Total CPU DRAM                 1920 MB
  Total SRAM                        0 MB
  Total SDRAM                       0 MB
  Start time                          2026-01-29 01:50:01 PST
  Uptime                              4 days, 15 hours, 39 minutes, 8 seconds       

 

root@QFX5100> show system uptime no-forwarding
System booted: 2025-02-23 23:51:22 PST (49w0d 17:37 ago)
Protocols started: 2025-02-23 23:53:13 PST (49w0d 17:35 ago)
 5:29PM  up 343 days, 17:38, 1 user, load averages: 0.26, 0.26, 0.24

 

root@QFX5100> show chassis routing-engine no-forwarding

Routing Engine status:
  Slot 0:
    Current state                  Master
    Model                          QFX Routing Engine
    Serial ID                      BUILTIN
    Start time                     2025-02-23 23:51:22 PST
    Uptime                         4 days, 15 hours, 38 minutes, 57 seconds
    Last reboot reason             0x4000:VJUNOS reboot
    Load averages:                 1 minute   5 minute  15 minute
                                       0.29       0.26       0.24

  • Core-dump will be generated:

 

root@QFX5100> show system core-dumps no-forwarding
-rw-rw---- 1 root field 10135408 May 14 2025 /var/tmp/fxpc.core.0.gz
-rw-rw---- 1 root field 9777568 Jun 7 2025 /var/tmp/fxpc.core.1.gz
-rw-rw---- 1 root field 10396844 Jan 29 01:49 /var/tmp/fxpc.core.2.gz
total files: 3

 

Solution

The PFE may crash when a lot of MAC learning and aging happens, but due to a Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization) that is outside the attackers direct control. Please refer to https://supportportal.juniper.net/JSA70610 [juniper.net] for more information.


Resolved In

Junos
19.1R3-S10
19.2R3-S7
19.3R3-S8
19.4R3-S10
20.2R3-S7
20.3R3-S6
20.3X75-D43
20.4R3-S5
21.1R3-S4
21.2R3-S3
21.3R3-S3
21.4R3
22.1R3
22.2R2
22.3R1
22.4R1


Modification History

2026-02-08 : Article Created