CVE-2026-81665

CVE-2026-81665 is a heap-based buffer overflow (CWE-122) in the message-reassembly code of Corosync's Totem Process Group (totempg) layer, where the buffer used to reassemble fragmented multicast messages performs no runtime bounds check in release builds. A network-adjacent attacker who can send crafted multicast protocol messages to the cluster communication path can overflow the heap with attacker-controlled data. The likely impact is a crash of the corosync daemon, producing a denial of service for the entire cluster, and with sufficient control over heap corruption the flaw may permit exploitation beyond denial of service. Any deployment running Corosync as its cluster messaging engine, the standard case for Linux high-availability clusters, is affected to the extent attackers can reach the cluster network; the available data does not specify affected version ranges, so administrators should check vendor advisories (the issue is coordinated by Red Hat as the assigned CNA, and the flaw is rated 7.5 High with an adjacent-network vector and high attack complexity). There is no known public proof-of-concept, the flaw is not in CISA KEV, and its EPSS score of 0.2% (11th percentile) indicates no known exploitation at this time.

What to do: Because no fixed versions are specified in the available data, track advisories from the Corosync project and the distributions that ship it (Red Hat, SUSE, Debian/Ubuntu, Proxmox) and install patched corosync packages as soon as they are released. In the meantime, restrict access to the cluster communication network used by Totem to trusted nodes only and check whether any untrusted systems share that segment, since adjacency to it is required to trigger the flaw. Monitor corosync daemon health and cluster availability, as the primary risk is a daemon crash taking down the whole cluster.