security update for corosync

CVE-2026-81665 is a heap-based buffer overflow vulnerability in the totempg assembly buffer of the Corosync Cluster Engine, triggered during the reassembly of fragmented messages. This flaw affects Corosync versions used in SUSE and Red Hat Enterprise Linux 8 distributions across multiple architectures including x86_64, aarch64, s390x, and ppc64le. Red Hat has released security updates (e.g., corosync-3.1.8-1.el8_10.2) to fix this issue. The vulnerability is tracked under CWE-122 (Heap-based Buffer Overflow) and has been assigned a high severity rating by the vendor. No known exploits in the wild have been reported at this time.

The heap-based buffer overflow in Corosync's totempg assembly buffer during fragmented message reassembly could lead to memory corruption, which may cause crashes or potentially allow an attacker to execute arbitrary code within the cluster communication process. This impacts the stability and security of cluster services relying on Corosync. The vulnerability affects multiple architectures and is considered high severity by the vendor.

Red Hat has released official security updates addressing CVE-2026-81665 in Corosync packages for Red Hat Enterprise Linux 8 and related variants. Users should apply these updates promptly to remediate the vulnerability. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. Since this is an official fix, no additional mitigation steps are required beyond applying the vendor-provided patches.