Medium [CVE-2026-81666] Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems
This medium-severity Red Hat Linux advisory covers CVE-2026-81666 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon.
This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
This vulnerability is rated as Moderate. The published Red Hat CVSS score is 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), matching the unmitigated upstream baseline for 32-bit deployments.
The integer overflow described only affects 32-bit builds, because C integer-promotion rules cause the vulnerable multiplication to be evaluated in 64-bit arithmetic on 64-bit systems, which prevents the overflow entirely.
Red Hat Enterprise Linux 8, 9, and 10 ship primarily 64-bit architectures (x86_64, aarch64), so this specific overflow mechanism does not apply to the vast majority of Red Hat deployments; this remains true regardless of the encryption scoring decision below.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- There is no complete mitigation for this vulnerability short of a fix, but the following steps reduce risk: 1. Ensure cluster message authentication is enabled in corosync.conf (crypto_cipher=aes256, crypto_hash=sha256 with a shared key from corosync-keygen), which is the default when clusters are configured via 'pcs cluster setup', and disabling it (cipher=none/hash=none) is an explicitly unsupported configuration per upstream maintainer guidance. 2. Restrict network access to the cluster communication ports (default 5405-5412/UDP) to trusted cluster node addresses only. 3. Where architecturally feasible, prefer 64-bit deployments, since the integer overflow described here does not occur on 64-bit systems.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.