EUVD-2026-45899
GHSA-32vg-vj46-3h6w
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Network-accessible reassembly engine reachable without authentication; AC:H reflects required precision in fragment crafting; A:H for crash/heap corruption, I:L for incidental memory modification, C:N as no data disclosure path exists.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The internal reassembly code does not properly validate sequence numbers of incoming payload fragments. An attacker can exploit this lack of verification by transmitting malformed packets with corrupted sequence parameters. Under specific conditions, this forces the packet processing layer to parse data outside the designated bounds of the internal memory structures, causing an out-of-bounds memory access or heap corruption. This behavior can result in sudden application crashes or system instability.
AnalysisAI
Out-of-bounds memory corruption in kronosnet's packet reassembly engine (versions ≤ 1.34) enables a remote, unauthenticated network attacker to crash the kronosnet process or cause heap corruption by transmitting malformed fragmented packets carrying invalid sequence numbers. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10, and Red Hat OpenShift Container Platform 4, making this relevant to HA clustering infrastructure that depends on kronosnet for inter-node communication via Corosync or Pacemaker. No public exploit code and no active exploitation have been identified at time of analysis, though the network-accessible, no-privilege-required attack path elevates operational risk for clustered environments despite the AC:H complexity rating.
Technical ContextAI
kronosnet is a low-level network interconnect library designed for high-availability cluster communication, typically consumed by Corosync and Pacemaker on Red Hat platforms. The vulnerability lies in the internal packet de-fragmentation (reassembly) engine, which reconstructs split network payloads from multiple incoming fragments. CWE-787 (Out-of-Bounds Write) is the root cause class: the reassembly logic uses incoming sequence number fields as indices or offsets into internal memory structures without sufficiently validating their range, allowing a crafted fragment stream to drive writes (or memory interpretation) beyond the allocated buffer boundary. This produces heap corruption that can manifest as immediate application crashes or latent memory instability. Confirmed affected CPEs cover kronosnet as shipped in RHEL 8 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_8), RHEL 9 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_9), RHEL 10 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_10), and OpenShift Container Platform 4 (cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4).
RemediationAI
No specific patched version number is confirmed in the available data at time of analysis; the definitive remediation is to apply the updated kronosnet package once Red Hat publishes it via their advisory at https://access.redhat.com/security/cve/CVE-2026-15813 - monitor that URL and the Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2500854 for package availability. As an interim compensating control, restrict network-level access to the cluster interconnect interfaces and ports used by kronosnet (typically multicast group addresses or dedicated unicast cluster IPs on rings configured in corosync.conf) to trusted cluster node IP addresses only, using firewalld rich rules or iptables on each node. This prevents untrusted external hosts from injecting malformed fragments into the reassembly engine. Note that overly restrictive firewall rules on multicast rings can disrupt cluster node discovery and quorum - validate rules against the specific corosync transport configuration (udpu vs. knet) before deploying in production. For OpenShift environments, enforce NetworkPolicy objects to restrict inter-node cluster traffic to known node CIDRs.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise High Availability Extension 16.0 | Affected |
| SUSE Linux Enterprise High Availability Extension 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today