kronosnet CVE-2026-15813

Exploitation requires the ability to send crafted fragmented network packets directly to a host running kronosnet with the packet processing engine active - meaning kronosnet must be deployed and operational, typically as part of a Corosync HA cluster. The cluster interconnect network (the network carrying kronosnet ring traffic) must be reachable by the attacker; this traffic is normally confined to a dedicated cluster VLAN or private subnet, limiting exposure to attackers already on that segment. The high attack complexity (AC:H) means the attacker cannot simply send arbitrary malformed packets - the fragment stream must be structured to trigger the specific reassembly state where the invalid sequence number is consumed, requiring protocol-level knowledge. What limits exploitation: the cluster interconnect is typically not internet-exposed; AC:H demands precise crafting rather than spray-and-pray; and the CVSS S:U scope indicates the impact is contained to the targeted node's kronosnet process. Exploitation is not feasible from the general internet without prior network access to the cluster communication plane.

The CVSS 3.1 score of 6.5 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H captures a dual reality: the attack requires no authentication or user interaction and is network-accessible (elevating base concern), but AC:H significantly reduces exploitability by requiring the attacker to craft packets that meet precise fragment reassembly state conditions - correct ordering, timing, or protocol state - making opportunistic or automated mass exploitation unlikely. The primary impact is availability (A:H), consistent with a crash or heap corruption scenario; integrity impact is minimal (I:L) and confidentiality is unaffected (C:N). No EPSS data was provided, so exploitation probability cannot be quantified from scoring systems. kronosnet is absent from the CISA KEV catalog and no POC is known, further supporting that this is a theoretical-to-low-exploitation risk currently. However, for organizations running Corosync/Pacemaker HA clusters on RHEL or OpenShift, the operational consequence of a kronosnet crash is disproportionately severe - it can trigger cluster split-brain conditions or node fencing, making the effective business risk higher than the 6.5 CVSS score alone implies for that population.

An attacker with access to the cluster interconnect network segment - such as a compromised node on the same VLAN or a rogue host with routing access to the cluster heartbeat network - transmits a crafted sequence of fragmented packets with deliberately malformed or out-of-range sequence number fields to the kronosnet listener. The reassembly engine, lacking proper bounds validation, uses the corrupted sequence value to index outside the allocated fragment buffer, corrupting adjacent heap memory. This causes the kronosnet process (and by extension, the Corosync communication layer) to crash, potentially triggering node fencing or cluster partition in an HA cluster. No public exploit code is known; the AC:H rating implies the attacker must understand the kronosnet fragmentation protocol well enough to produce the triggering packet sequence.