CVE-2026-81666: Integer Overflow or Wraparound in Red Hat Red Hat Enterprise Linux 10

An integer overflow in Corosync's membership commit token message handling on 32-bit Red Hat Enterprise Linux 10 systems allows bypassing of length-validation checks. This leads to out-of-bounds memory access and crashes the Corosync daemon, causing denial of service on the affected cluster node. The overflow does not occur on 64-bit systems due to 64-bit arithmetic. The vulnerability is rated moderate (CVSS 6.5) with no confidentiality or integrity impact but high availability impact. Default cluster message authentication (enabled by default in clusters configured via 'pcs cluster setup') reduces risk but can be disabled through supported configuration, so the worst-case scenario is considered for scoring. No official patch or fix is currently published. Mitigations include ensuring cluster message authentication is enabled, restricting network access to cluster communication ports, and preferring 64-bit deployments. This vulnerability affects Corosync shipped in RHEL 7 through 10 as part of the High Availability Add-On.

The vulnerability causes denial of service by crashing the Corosync daemon on affected 32-bit cluster nodes due to out-of-bounds memory access triggered by crafted network packets. There is no impact on confidentiality or integrity. The issue does not affect 64-bit systems. Default cluster message authentication reduces the practical risk but can be disabled, so the risk remains for configurations without authentication. The availability impact is high on vulnerable 32-bit systems without message authentication.

No complete fix is currently available. To reduce risk: 1) Ensure cluster message authentication is enabled in corosync.conf (crypto_cipher=aes256, crypto_hash=sha256 with a shared key), which is the default when clusters are configured via 'pcs cluster setup'. Disabling authentication (cipher=none/hash=none) is explicitly unsupported. 2) Restrict network access to cluster communication ports (UDP 5405-5412) to trusted cluster nodes only. 3) Prefer 64-bit deployments where feasible, as the vulnerability does not affect 64-bit systems. Monitor Red Hat advisories for future patches or updates.