The vulnerability CVE-2026-35091 affects the Corosync Cluster Engine in Red Hat Enterprise Linux 10. It arises from an incorrect check of a function return value during the membership commit token sanity check, which can be triggered remotely without authentication via a crafted UDP packet. Exploitation can lead to an out-of-bounds read, resulting in denial of service and potential limited information disclosure. Red Hat has issued security advisories and updates that fix this vulnerability by updating the corosync packages. The advisories cover multiple architectures and variants of Red Hat Enterprise Linux 10 and 8. The CVSS 3.1 base score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H), reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation allows a remote unauthenticated attacker to cause an out-of-bounds read in the Corosync membership commit token sanity check, leading to denial of service and potential disclosure of limited memory contents. This can disrupt cluster services relying on Corosync, impacting availability and confidentiality to a limited extent. There are no known exploits in the wild at this time.

Red Hat has released official security updates for the corosync packages that address CVE-2026-35091. Applying these updates as per Red Hat's advisories (RHSA-2026:13644 for RHEL 10 and RHSA-2026:13657 for RHEL 8) is the recommended remediation. Detailed update instructions are available at https://access.redhat.com/articles/11258. Systems running affected versions of Red Hat Enterprise Linux should be updated promptly to mitigate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.