The vulnerability CVE-2026-10649 exists in the Pacemaker component of Red Hat Enterprise Linux 8 and 9. It is caused by an integer overflow or wraparound during the remote message decompression process. An unauthenticated remote attacker can send a maliciously crafted compressed message to trigger memory corruption, leading to a denial of service condition by crashing the CIB remote listener service. This flaw impacts the availability of the cluster resource manager. Red Hat has issued security advisories RHSA-2026:39322 and RHSA-2026:39323 providing patches for affected versions.

Successful exploitation allows an unauthenticated remote attacker to cause a denial of service by crashing the Pacemaker CIB remote listener, disrupting cluster resource management and potentially affecting data integrity and application availability in clustered environments. The confidentiality and integrity impacts are rated low, but availability impact is high. No known exploits in the wild have been reported at this time.

Red Hat has released official security updates that fix this vulnerability. Users should apply the provided patches for Pacemaker as detailed in Red Hat advisories RHSA-2026:39322 (for RHEL 8) and RHSA-2026:39323 (for RHEL 9). The advisories include instructions on updating affected packages. Applying these updates will remediate the integer overflow vulnerability and prevent denial of service attacks via this vector.