CVE-2026-81666
Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems
What happened?
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
Affected software and versions
| Software | Version information | Fixed version |
|---|---|---|
| corosyncRed Hat | Default status: affected | See vendor advisory |
| corosyncRed Hat | Default status: affected | See vendor advisory |
| corosyncRed Hat | Default status: affected | See vendor advisory |
| corosyncRed Hat | Default status: affected | See vendor advisory |
| openshift/ose-rhel-coreos-9Red Hat | Default status: affected | See vendor advisory |
| rhcosRed Hat | Default status: affected | See vendor advisory |
| openshift/ose-rhel-coreos-9Red Hat | Default status: affected | See vendor advisory |
Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.
Is it being exploited?
This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.
How to respond
- Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
- Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
- Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.