CVE-2026-35092: 
NixOS vulnerability analysis and mitigation

CVE-2026-35092 is an integer overflow (wraparound) vulnerability in Corosync's join message sanity validation that allows a remote, unauthenticated attacker to crash the service via crafted UDP packets, resulting in a denial of service. The flaw resides in the check_memb_join_sanity() function within exec/totemsrp.c and exclusively affects Corosync deployments configured to use totemudp/totemudpu mode. It was reported by researcher Sebastian Alba Vives (@Sebasteuo / 0xS4bb1) on March 30, 2026, and publicly disclosed on April 1, 2026. Affected products include Corosync (all versions prior to patched releases), Red Hat Enterprise Linux 7, 8, 9, and 10, and Red Hat OpenShift 4.0. The CVSS v3.1 base score is 7.5 (High) (Red Hat CVE, GitHub Advisory).

The root cause is a CWE-190 (Integer Overflow or Wraparound) in check_memb_join_sanity() in exec/totemsrp.c. The attacker-controlled 32-bit unsigned values proc_list_entries and failed_list_entries are received from the network and summed before being promoted to size_t; by supplying values such as 0x80000000 + 0x80000000, the 32-bit addition wraps to zero, causing required_len to be calculated too small and allowing a malformed short packet to pass bounds validation. Corosync then proceeds to process the malformed input, leading to a service crash. Exploitation requires no authentication and no user interaction, but the target must be running Corosync in totemudp or totemudpu transport mode. A C-language proof-of-concept harness (harness_bug1_minimal.c) with ASAN-confirmed output was attached to the original bug report (Red Hat Bugzilla 2453169, Red Hat Bugzilla 2453814).

Successful exploitation causes the Corosync cluster engine to crash, resulting in a complete loss of cluster communication availability for all nodes relying on the affected Corosync instance. This can disrupt high-availability (HA) cluster services — including those underpinning Red Hat Enterprise Linux HA, OpenShift, and other cluster-dependent workloads — potentially causing service outages across the entire cluster. There is no confidentiality or integrity impact; the vulnerability is purely a denial-of-service condition (Red Hat CVE, GitHub Advisory).

A proof-of-concept exploit (C source code with ASAN-confirmed reproduction steps) is publicly available via the Red Hat Bugzilla report (Red Hat Bugzilla 2453169). As of the time of reporting, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.31–1.0% (low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify Corosync cluster nodes with UDP ports exposed (default port 5405) using network scanning tools such as Nmap (nmap -sU -p 5405 <target>). Confirm the target is running Corosync in totemudp or totemudpu transport mode by reviewing publicly available configuration or banner information.
2. Craft malicious join message: Construct a UDP packet targeting Corosync's totem ring protocol that contains a join message with proc_list_entries and failed_list_entries fields each set to 0x80000000 (or other values that sum to zero or a very small number in 32-bit arithmetic).
3. Trigger integer overflow: Send the crafted UDP packet to the target Corosync node's ring communication port. The check_memb_join_sanity() function in exec/totemsrp.c will compute (0x80000000 + 0x80000000) in 32-bit arithmetic, yielding 0, causing required_len to be underestimated and the malformed packet to pass bounds validation.
4. Achieve denial of service: Corosync processes the malformed join message, triggering a crash (heap-buffer-overflow or similar memory corruption), which terminates the Corosync service and disrupts cluster communication for all dependent nodes (Red Hat Bugzilla 2453169).

• Network: Unexpected or repeated UDP packets to Corosync ring ports (default UDP/5405) from external or untrusted IP addresses; packets with anomalously large or crafted proc_list_entries/failed_list_entries field values in join messages.
• Logs: Corosync service crash entries in /var/log/messages or journalctl -u corosync; ASAN output referencing heap-buffer-overflow or integer overflow in check_memb_join_sanity or check_memb_commit_token_sanity; corosync core dump files in the working directory.
• Process: Unexpected termination of the corosync process; cluster fencing or split-brain events triggered without a known hardware or network failure; repeated automatic restarts of the corosync service by systemd.

Red Hat has released patched packages addressing CVE-2026-35092 across multiple RHEL versions: RHSA-2026:13644 (RHEL 10), RHSA-2026:13657 (RHEL 8), RHSA-2026:13673 (RHEL 9), RHSA-2026:20916 (RHEL 7 ELS), and additional EUS/SAP/TUS advisories (RHSA-2026:14205 through RHSA-2026:14216). For Fedora, fixed versions are corosync-3.1.10-2.fc43, corosync-3.1.9-4.fc42, and corosync-3.1.10-5.fc44. Ubuntu (USN-8170-1), Amazon Linux 2023 (ALAS2023-2026-1560), openSUSE, Debian (DSA-6261-1 / DLA-4608-1), and AlmaLinux have also issued patches. As a workaround, restrict network access to Corosync UDP ports (default 5405) to trusted cluster members only using firewall rules, reducing the attack surface for unauthenticated remote attackers (Red Hat RHSA-2026:13644, GitHub Advisory).

The vulnerability was reported by independent researcher Sebastian Alba Vives and coordinated through Red Hat's security response process with a 90-day disclosure deadline. Red Hat rated the issue as "Moderate" severity in their errata advisories. Coverage appeared across Linux security news aggregators (linuxsecurity.com, linuxcompatible.org, pro-linux.de) and automated CVE tracking feeds shortly after disclosure. No significant controversy or notable researcher commentary beyond the original bug report has been observed (Red Hat Bugzilla 2453169, Red Hat RHSA-2026:13644).