kronosnet CVE-2026-15811

Exploitation requires a local authenticated account with at least low-level operating system privileges on a node running kronosnet version 1.34 or earlier (PR:L per CVSS). A cryptographic configuration change must occur during or after the attacker's session to place key material in freed memory; an attacker cannot exploit stale key residue from before they obtained access. High attack complexity (AC:H) means the attacker must additionally possess or leverage a reliable memory disclosure primitive capable of reading freed heap pages before the allocator reclaims them - this is non-trivial under ASLR and glibc heap hardening. ptrace-based access to peer processes is blocked by default on RHEL with Yama LSM (ptrace_scope=1), requiring the attacker to target their own process's freed memory or have a secondary disclosure primitive. Remote exploitation is not possible; this is strictly a local privilege and information-disclosure chain. The flaw is only triggered when a cryptographic configuration change is executed at runtime - static deployments with no mid-session key changes may not expose key material in this window.

The CVSS 3.1 score of 5.8 (Medium) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L correctly reflects that exploitation is bounded to local, authenticated access with high attack complexity - modern mitigations (ASLR, heap hardening, ptrace restrictions via Yama LSM) meaningfully raise the bar for reliable key extraction. Despite the moderate composite score, the confidentiality component is rated High (C:H), which is the most consequential signal here: full recovery of the cluster encryption key collapses confidentiality of all cluster network traffic, not just a single data element. Integrity (I:L) and availability (A:L) impacts reflect the additional capability to inject forged cluster packets and induce split-brain or fencing failures. No EPSS data was provided; however, the absence of a KEV listing and no known POC indicate this has not been weaponized at scale. The realistic threat actor is an insider or an attacker who has already achieved low-privileged code execution on a cluster node - at that point the elevated cluster communication impact makes exploitation strategically valuable despite the access prerequisites. Risk is elevated in environments where cluster encryption keys are the last trust boundary protecting intra-cluster traffic.

An attacker with a low-privileged local account on an RHEL HA cluster node waits for or deliberately triggers a cryptographic configuration change in kronosnet (for example, by initiating a corosync key reload). Immediately following the change, the attacker uses a memory disclosure technique - such as /proc/pid/mem inspection, a ptrace-based heap scanner, or a secondary memory disclosure vulnerability - to locate and read the freed heap region still containing residual plaintext key material. With the recovered key, the attacker decrypts captured cluster heartbeat traffic or crafts authenticated-looking cluster packets to trigger split-brain behavior or spurious node fencing.