EUVD-2026-46153
GHSA-3p9p-8j59-v9h3
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Local-only vector with low privilege and high complexity accurately reflects the requirement for both shell access and a reliable memory disclosure primitive to recover heap-resident key material.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw encryption keys resident in memory after the associated structures are freed. A local attacker capable of leveraging memory disclosure techniques could exploit this flaw to retrieve the active encryption key, allowing them to decrypt cluster network communications or inject malicious packets to cause severe high-availability cluster instability.
AnalysisAI
Sensitive memory exposure in kronosnet (versions <=1.34) allows a local attacker to recover live cluster encryption keys from freed heap memory following cryptographic configuration changes. Affected deployments include Red Hat Enterprise Linux 8, 9, 10, and OpenShift Container Platform 4, where kronosnet underpins the high-availability networking stack. Successful key recovery enables full decryption of cluster communications or malicious packet injection capable of destabilizing HA cluster quorum - no public exploit code identified and no CISA KEV listing at time of analysis.
Technical ContextAI
kronosnet (knet) is a network abstraction and transport multiplexer library that forms the cryptographic backbone of Red Hat's high-availability clustering stack, typically paired with corosync and pacemaker. It manages per-link encryption keys for intra-cluster communications. CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer) is the root cause: when cryptographic configuration is changed at runtime, the framework deallocates associated memory structures without first zeroing the key material they contain. This leaves raw symmetric encryption keys resident in freed heap pages, accessible via memory disclosure primitives before the allocator reclaims and overwrites the region. Affected CPEs confirm the flaw is present across cpe:2.3:a:red_hat:red_hat_enterprise_linux_8, _9, and _10, as well as cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4.
RemediationAI
The primary remediation is to upgrade kronosnet to a version beyond 1.34 once a patched release is confirmed - monitor https://access.redhat.com/security/cve/CVE-2026-15811 and https://bugzilla.redhat.com/show_bug.cgi?id=2500849 for the exact fixed package version, as no specific patched version is named in currently available data. As compensating controls while awaiting a patch: restrict local shell access to cluster nodes to the minimum required administrative accounts; enforce ptrace scope restrictions by setting /proc/sys/kernel/yama/ptrace_scope to 1 or 2, which prevents non-root processes from inspecting peer process memory (trade-off: may break some debugging and profiling tools); and implement periodic cluster encryption key rotation to limit the useful lifetime of any key recovered from freed memory. Hardening the cluster nodes with SELinux in enforcing mode can further constrain memory inspection capabilities available to low-privileged local users. Do not rely solely on network-layer controls, as this is a local attack vector.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise High Availability Extension 16.0 | Affected |
| SUSE Linux Enterprise High Availability Extension 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today