CVE-2026-81666: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-81666 is an integer overflow vulnerability in Corosync's handling of membership commit token messages that can cause a denial of service on 32-bit systems. The flaw exists in the check_memb_commit_token_sanity() function in exec/totemsrp.c, where an attacker-controlled 32-bit field from a network packet can cause the message length calculation to overflow, allowing a crafted packet to bypass length validation and crash the Corosync daemon. The vulnerability affects Corosync as shipped in Red Hat Enterprise Linux 7 through 10 and RHIVOS (as part of the High Availability Add-On), but does not affect 64-bit deployments where C integer-promotion rules prevent the overflow. It was published on September 4, 2026, with a CVSS v3.1 base score of 6.5 (Medium), assigned by Red Hat (Red Hat CVE, GitHub Advisory).

The root cause is an integer overflow (CWE-190) in check_memb_commit_token_sanity() within exec/totemsrp.c. The function computes required_len = sizeof(struct memb_commit_token) + (addr_entries * (sizeof(struct srp_addr) + sizeof(struct memb_commit_token_memb_entry))), where addr_entries is an attacker-controlled 32-bit field from a network packet and the per-entry size is 28 bytes. On 32-bit architectures where size_t is 32-bit, when addr_entries >= 153,391,690, the multiplication wraps required_len to a small value (e.g., 65), allowing a short ~100-byte crafted packet to pass the length check. The subsequent memb_commit_token_endian_convert() then iterates addr_entries times over the small buffer, causing an out-of-bounds read/write and an immediate crash. This vulnerability is related to CVE-2026-35092, whose fix added a PROCESSOR_COUNT_MAX bounds check and explicit size_t casts to check_memb_join_sanity() only — check_memb_commit_token_sanity() was not patched. The vulnerability was reported by Tristan Madani of Talence Security (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in a denial of service: an unauthenticated attacker on the adjacent network can crash the Corosync daemon on a 32-bit cluster node by sending a single crafted UDP packet. This causes the affected cluster node to lose cluster membership, potentially disrupting high-availability services dependent on the cluster. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The impact is scoped to the individual cluster node; however, repeated crashes could destabilize the entire cluster if multiple nodes are targeted (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of publication (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.271% (19th percentile), indicating a low probability of exploitation in the near term (GitHub Advisory). Exploitation requires adjacent network access to cluster communication ports, and the default RHEL HA cluster configuration (with crypto_hash=sha256 and crypto_cipher=aes256 enabled via pcs cluster setup) significantly reduces practical risk by requiring a valid shared key to inject packets. No threat actor attribution has been reported.

1. Reconnaissance: Identify target cluster nodes running Corosync on 32-bit systems with cluster message authentication disabled. Scan for open UDP ports 5405–5412 on the adjacent network segment using tools like nmap.
2. Craft malicious packet: Construct a membership commit token message (TOTEM_MSG_TYPE_MEMB_COMMIT_TOKEN) with addr_entries set to a value ≥ 153,391,690 (e.g., 0x927C00A) to trigger the 32-bit integer overflow in check_memb_commit_token_sanity().
3. Bypass length validation: Due to the overflow, required_len wraps to a small value (e.g., 65 bytes), causing the length check to pass for a short ~100-byte packet that would otherwise be rejected.
4. Trigger out-of-bounds access: Send the crafted UDP packet to the Corosync cluster communication port (default 5405/UDP). The daemon's memb_commit_token_endian_convert() function iterates addr_entries times over the small buffer, causing an out-of-bounds read/write.
5. Achieve denial of service: The Corosync daemon crashes, removing the targeted node from the cluster and disrupting any high-availability services dependent on it (Red Hat Bugzilla, Red Hat CVE).

• Network: Unexpected or malformed UDP packets on cluster communication ports (5405–5412/UDP) originating from non-cluster-member IP addresses; packets with unusually large addr_entries field values in Totem protocol messages.
• Logs: Corosync daemon crash entries in /var/log/messages or journalctl -u corosync; segmentation fault or SIGABRT signals attributed to the corosync process; cluster node departure events logged by Pacemaker (crm_mon or pcs status).
• Process: Unexpected termination and restart of the corosync process; core dump files generated in the Corosync working directory (typically /var/lib/corosync/ or /tmp/).
• File System: Presence of core dump files (e.g., core.*) associated with the corosync binary following unexpected crashes.

A patch is available; administrators should apply the fixed Corosync package provided by their distribution (Red Hat, Fedora, openSUSE, Debian) (Red Hat CVE, openSUSE Advisory). Until patching is possible, the following mitigations reduce risk:

1. Enable cluster message authentication: Ensure crypto_cipher=aes256 and crypto_hash=sha256 are set in corosync.conf with a shared key from corosync-keygen (the default when configured via pcs cluster setup). This prevents unauthenticated packet injection and reduces effective CVSS to 4.5.
2. Restrict network access: Limit access to cluster communication ports (5405–5412/UDP) to trusted cluster node IP addresses using firewall rules.
3. Prefer 64-bit deployments: The integer overflow does not occur on 64-bit systems (x86_64, aarch64), which are the primary architectures for RHEL 8, 9, and 10 (Red Hat CVE).

Red Hat rated the vulnerability as Moderate and provided a detailed statement noting that the vast majority of RHEL deployments are unaffected due to 64-bit architecture and default cluster authentication settings. Red Hat credited upstream Corosync maintainer Jan Friesse for confirming the scope of the default authentication protection and noted that upstream Corosync HEAD and current Fedora now enforce encryption at compile time, which will eventually eliminate the risk entirely for future RHEL releases (Red Hat CVE). German Linux security outlet Pro-Linux.de covered the vulnerability as part of a broader Corosync security advisory (Pro-Linux). The vulnerability was also covered in a Linux security roundup by LinuxCompatible.org alongside other critical patches.