Corosync CVE-2026-81666

The target system must be running a 32-bit operating system - the integer overflow in the Corosync message length calculation occurs only under the ILP32 ABI where 32-bit arithmetic wraps before the bounds check; 64-bit systems are explicitly immune. The attacker must have network-layer adjacency to the cluster ring interface (CVSS AV:A), which is typically a dedicated VLAN or physical segment separate from public networks. No authentication or credentials are required at the Corosync protocol level (CVSS PR:N). The vulnerable membership commit token processing path is a core Corosync function active in all standard cluster configurations and cannot be disabled without breaking cluster membership entirely. Exploitation is therefore restricted to: (a) 32-bit RHEL or OpenShift cluster nodes, which are uncommon in modern environments, and (b) attackers who can reach the cluster ring network interface.

Real-world risk is moderate and substantially narrowed by the 32-bit-only constraint. The provided CVSS 6.5 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector accurately reflects that the attack requires adjacent network access to the cluster ring with no credentials, but AC:L arguably understates exploitability requirements given that 32-bit RHEL cluster deployments are increasingly rare in contemporary production environments; most modern RHEL HA clusters run 64-bit hardware and are entirely unaffected. No EPSS data is present in the provided sources. KEV status is negative and no public exploit code has been identified, so exploitation remains theoretical. The primary risk is limited to legacy 32-bit RHEL or OpenShift cluster nodes still in service; on such nodes, the cluster ring network is typically an isolated VLAN but may be reachable from any host on the same physical segment or management plane. Crashing the Corosync daemon removes the node from quorum participation, which can cascade into cluster-wide failover disruption in HA environments - availability impact in production is therefore potentially greater than a raw DoS-only CVSS suggests.

An attacker with access to the cluster's dedicated ring network - for example, a compromised host on the same management VLAN - sends a crafted UDP membership commit token message with a manipulated length field to a 32-bit Corosync node. On the 32-bit target, the length validation arithmetic overflows, the bounds check is bypassed, the resulting out-of-bounds memory access crashes the Corosync daemon, and the node is ejected from quorum, triggering failover or cluster degradation. No public exploit code exists, but the attack primitive is straightforward to implement once the overflow offset is determined through binary analysis.