Bug 2524910 (CVE-2026-81665)

Summary:	CVE-2026-81665 corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2528437
Bug Blocks:

Description OSIDB Bzimport 2026-08-27 10:44:31 UTC

Corosync is a group communication system providing reliable ordered messaging and membership services, and is the communication layer underlying Pacemaker HA clusters (RHEL High Availability Add-On). In exec/totempg.c, the totempg_deliver_fn function reassembles fragmented multicast messages into a fixed-size per-node assembly buffer (struct assembly, data[MESSAGE_SIZE_MAX + KNET_MAX_PACKET_SIZE], ~1.06 MB on normal builds, ~128 KB on small-memory-footprint builds). The only bounds check before the memcpy at line 663 is an assert() at line 662, which is compiled out in release builds (-DNDEBUG). assembly->index grows unboundedly at line 737 for each continuation fragment with no upper-bound check. After 17-18 fragments on normal builds (3 fragments on small-memory-footprint builds), the memcpy writes attacker-controlled data past the end of the heap buffer.

Verified via an ASan-instrumented standalone harness reproducing the exact buffer layout and memcpy/index logic: after 17 fragments of 65,481 bytes each, assembly->index reached 1,113,177 (buffer capacity 1,114,112); fragment 18 triggered a confirmed heap-buffer-overflow WRITE of 65,481 bytes, 64,546 bytes past the buffer end.

Present in corosync v3.1.10 (latest upstream release) and main HEAD (commit 65235a8); no upstream fix exists for this bug. Reported by Tristan Madani (Talence Security) via PSIRTSUPT-22352.