Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-81665

Fixed in a distro release EPSS <1%CVSS 7.5

A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.

Published 2026-09-04 · CVE record · OSV

Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat OpenShift Container Platform 4

Distro releases

ReleasePackageFixed in
AlmaLinux 10corosync3.1.10-1.el10_2.2
AlmaLinux 10corosync-vqsim3.1.10-1.el10_2.2
AlmaLinux 10corosynclib3.1.10-1.el10_2.2
AlmaLinux 10corosynclib-devel3.1.10-1.el10_2.2
AlmaLinux 8corosync3.1.8-1.el8_10.2
AlmaLinux 8corosync-vqsim3.1.8-1.el8_10.2
AlmaLinux 8corosynclib3.1.8-1.el8_10.2
AlmaLinux 8corosynclib-devel3.1.8-1.el8_10.2
AlmaLinux 8spausedd3.1.8-1.el8_10.2
AlmaLinux 9corosync3.1.10-1.el9_8.2
AlmaLinux 9corosync-vqsim3.1.10-1.el9_8.2
AlmaLinux 9corosynclib3.1.10-1.el9_8.2
AlmaLinux 9corosynclib-devel3.1.10-1.el9_8.2
Debian 12corosyncno fix
Debian 13corosyncno fix
Debian 14corosyncno fix
Red Hat Enterprise Linux 10.2corosync0:3.1.10-1.el10_2.2
Red Hat Enterprise Linux 10.2corosync-debuginfo0:3.1.10-1.el10_2.2
Red Hat Enterprise Linux 10.2corosync-debugsource0:3.1.10-1.el10_2.2
Red Hat Enterprise Linux 10.2corosync-vqsim0:3.1.10-1.el10_2.2
Red Hat Enterprise Linux 10.2corosync-vqsim-debuginfo0:3.1.10-1.el10_2.2
Red Hat Enterprise Linux 10.2corosynclib0:3.1.10-1.el10_2.2
Red Hat Enterprise Linux 10.2corosynclib-debuginfo0:3.1.10-1.el10_2.2
Red Hat Enterprise Linux 10.2corosynclib-devel0:3.1.10-1.el10_2.2
Red Hat Enterprise Linux 7corosync0:2.4.5-7.el7_9.4
Red Hat Enterprise Linux 7corosync-debuginfo0:2.4.5-7.el7_9.4
Red Hat Enterprise Linux 7corosync-qdevice0:2.4.5-7.el7_9.4
Red Hat Enterprise Linux 7corosync-qnetd0:2.4.5-7.el7_9.4
Red Hat Enterprise Linux 7corosynclib0:2.4.5-7.el7_9.4
Red Hat Enterprise Linux 7corosynclib-devel0:2.4.5-7.el7_9.4
Red Hat Enterprise Linux 7spausedd0:2.4.5-7.el7_9.4
Red Hat Enterprise Linux 8corosync0:3.1.8-1.el8_10.2
Red Hat Enterprise Linux 8corosync-debuginfo0:3.1.8-1.el8_10.2
Red Hat Enterprise Linux 8corosync-debugsource0:3.1.8-1.el8_10.2
Red Hat Enterprise Linux 8corosync-vqsim0:3.1.8-1.el8_10.2
Red Hat Enterprise Linux 8corosync-vqsim-debuginfo0:3.1.8-1.el8_10.2
Red Hat Enterprise Linux 8corosynclib0:3.1.8-1.el8_10.2
Red Hat Enterprise Linux 8corosynclib-debuginfo0:3.1.8-1.el8_10.2
Red Hat Enterprise Linux 8corosynclib-devel0:3.1.8-1.el8_10.2
Red Hat Enterprise Linux 8spausedd0:3.1.8-1.el8_10.2
Red Hat Enterprise Linux 8spausedd-debuginfo0:3.1.8-1.el8_10.2
Red Hat Enterprise Linux 9corosync0:3.1.10-1.el9_8.2
Red Hat Enterprise Linux 9corosync-debuginfo0:3.1.10-1.el9_8.2
Red Hat Enterprise Linux 9corosync-debugsource0:3.1.10-1.el9_8.2
Red Hat Enterprise Linux 9corosync-vqsim0:3.1.10-1.el9_8.2
Red Hat Enterprise Linux 9corosync-vqsim-debuginfo0:3.1.10-1.el9_8.2
Red Hat Enterprise Linux 9corosynclib0:3.1.10-1.el9_8.2
Red Hat Enterprise Linux 9corosynclib-debuginfo0:3.1.10-1.el9_8.2
Red Hat Enterprise Linux 9corosynclib-devel0:3.1.10-1.el9_8.2
Red Hat Enterprise Linux eus 10.0corosync0:3.1.9-1.el10_0.3
Red Hat Enterprise Linux eus 10.0corosync-debuginfo0:3.1.9-1.el10_0.3
Red Hat Enterprise Linux eus 10.0corosync-debugsource0:3.1.9-1.el10_0.3
Red Hat Enterprise Linux eus 10.0corosync-vqsim0:3.1.9-1.el10_0.3
Red Hat Enterprise Linux eus 10.0corosync-vqsim-debuginfo0:3.1.9-1.el10_0.3
Red Hat Enterprise Linux eus 10.0corosynclib0:3.1.9-1.el10_0.3
Red Hat Enterprise Linux eus 10.0corosynclib-debuginfo0:3.1.9-1.el10_0.3
Red Hat Enterprise Linux eus 10.0corosynclib-devel0:3.1.9-1.el10_0.3
Red Hat rhel aus 8.4corosync0:3.1.0-3.el8_4.3
Red Hat rhel aus 8.4corosync-debuginfo0:3.1.0-3.el8_4.3
Red Hat rhel aus 8.4corosync-debugsource0:3.1.0-3.el8_4.3
Red Hat rhel aus 8.4corosync-vqsim-debuginfo0:3.1.0-3.el8_4.3
Red Hat rhel aus 8.4corosynclib0:3.1.0-3.el8_4.3
Red Hat rhel aus 8.4corosynclib-debuginfo0:3.1.0-3.el8_4.3
Red Hat rhel aus 8.4corosynclib-devel0:3.1.0-3.el8_4.3
Red Hat rhel aus 8.4spausedd0:3.1.0-3.el8_4.3
Red Hat rhel aus 8.4spausedd-debuginfo0:3.1.0-3.el8_4.3
Red Hat rhel aus 8.6corosync0:3.1.5-2.el8_6.2
Red Hat rhel aus 8.6corosync-debuginfo0:3.1.5-2.el8_6.2
Red Hat rhel aus 8.6corosync-debugsource0:3.1.5-2.el8_6.2
Red Hat rhel aus 8.6corosync-vqsim-debuginfo0:3.1.5-2.el8_6.2
Red Hat rhel aus 8.6corosynclib0:3.1.5-2.el8_6.2
Red Hat rhel aus 8.6corosynclib-debuginfo0:3.1.5-2.el8_6.2
Red Hat rhel aus 8.6spausedd-debuginfo0:3.1.5-2.el8_6.2
Red Hat rhel e4s 8.8corosync0:3.1.7-1.el8_8.2
Red Hat rhel e4s 8.8corosync-debuginfo0:3.1.7-1.el8_8.2
Red Hat rhel e4s 8.8corosync-debugsource0:3.1.7-1.el8_8.2
Red Hat rhel e4s 8.8corosync-vqsim-debuginfo0:3.1.7-1.el8_8.2
Red Hat rhel e4s 8.8corosynclib0:3.1.7-1.el8_8.2
Red Hat rhel e4s 8.8corosynclib-debuginfo0:3.1.7-1.el8_8.2
Red Hat rhel e4s 8.8corosynclib-devel0:3.1.7-1.el8_8.2
Red Hat rhel e4s 8.8spausedd0:3.1.7-1.el8_8.2
Red Hat rhel e4s 8.8spausedd-debuginfo0:3.1.7-1.el8_8.2
Red Hat rhel e4s 9.2corosync0:3.1.7-1.el9_2.2
Red Hat rhel e4s 9.2corosync-debuginfo0:3.1.7-1.el9_2.2
Red Hat rhel e4s 9.2corosync-debugsource0:3.1.7-1.el9_2.2
Red Hat rhel e4s 9.2corosync-vqsim-debuginfo0:3.1.7-1.el9_2.2
Red Hat rhel e4s 9.2corosynclib0:3.1.7-1.el9_2.2
Red Hat rhel e4s 9.2corosynclib-debuginfo0:3.1.7-1.el9_2.2
Red Hat rhel e4s 9.2corosynclib-devel0:3.1.7-1.el9_2.2
Red Hat rhel e4s 9.4corosync0:3.1.8-1.el9_4.2
Red Hat rhel e4s 9.4corosync-debuginfo0:3.1.8-1.el9_4.2
Red Hat rhel e4s 9.4corosync-debugsource0:3.1.8-1.el9_4.2
Red Hat rhel e4s 9.4corosync-vqsim-debuginfo0:3.1.8-1.el9_4.2
Red Hat rhel e4s 9.4corosynclib0:3.1.8-1.el9_4.2
Red Hat rhel e4s 9.4corosynclib-debuginfo0:3.1.8-1.el9_4.2
Red Hat rhel e4s 9.4corosynclib-devel0:3.1.8-1.el9_4.2
Red Hat rhel eus 9.6corosync0:3.1.9-2.el9_6.2
Red Hat rhel eus 9.6corosync-debuginfo0:3.1.9-2.el9_6.2
Red Hat rhel eus 9.6corosync-debugsource0:3.1.9-2.el9_6.2
Red Hat rhel eus 9.6corosync-vqsim0:3.1.9-2.el9_6.2
Red Hat rhel eus 9.6corosync-vqsim-debuginfo0:3.1.9-2.el9_6.2
Red Hat rhel eus 9.6corosynclib0:3.1.9-2.el9_6.2
Red Hat rhel eus 9.6corosynclib-debuginfo0:3.1.9-2.el9_6.2
Red Hat rhel eus 9.6corosynclib-devel0:3.1.9-2.el9_6.2
Red Hat rhel eus long life 8.4corosync0:3.1.0-3.el8_4.3
Red Hat rhel eus long life 8.4corosync-debuginfo0:3.1.0-3.el8_4.3
Red Hat rhel eus long life 8.4corosync-debugsource0:3.1.0-3.el8_4.3
Red Hat rhel eus long life 8.4corosync-vqsim-debuginfo0:3.1.0-3.el8_4.3
Red Hat rhel eus long life 8.4corosynclib0:3.1.0-3.el8_4.3
Red Hat rhel eus long life 8.4corosynclib-debuginfo0:3.1.0-3.el8_4.3
Red Hat rhel eus long life 8.4corosynclib-devel0:3.1.0-3.el8_4.3
Red Hat rhel eus long life 8.4spausedd0:3.1.0-3.el8_4.3
Red Hat rhel eus long life 8.4spausedd-debuginfo0:3.1.0-3.el8_4.3
Red Hat rhel eus long life 8.6corosync0:3.1.5-2.el8_6.2
Red Hat rhel eus long life 8.6corosync-debuginfo0:3.1.5-2.el8_6.2
Red Hat rhel eus long life 8.6corosync-debugsource0:3.1.5-2.el8_6.2
Red Hat rhel eus long life 8.6corosync-vqsim-debuginfo0:3.1.5-2.el8_6.2
Red Hat rhel eus long life 8.6corosynclib0:3.1.5-2.el8_6.2
Red Hat rhel eus long life 8.6corosynclib-debuginfo0:3.1.5-2.el8_6.2
Red Hat rhel eus long life 8.6corosynclib-devel0:3.1.5-2.el8_6.2
Red Hat rhel eus long life 8.6spausedd0:3.1.5-2.el8_6.2
Red Hat rhel eus long life 8.6spausedd-debuginfo0:3.1.5-2.el8_6.2
Red Hat rhel tus 8.8corosync0:3.1.7-1.el8_8.2
Red Hat rhel tus 8.8corosync-debuginfo0:3.1.7-1.el8_8.2
Red Hat rhel tus 8.8corosync-debugsource0:3.1.7-1.el8_8.2
Red Hat rhel tus 8.8corosync-vqsim-debuginfo0:3.1.7-1.el8_8.2
Red Hat rhel tus 8.8corosynclib0:3.1.7-1.el8_8.2
Red Hat rhel tus 8.8corosynclib-debuginfo0:3.1.7-1.el8_8.2
Red Hat rhel tus 8.8corosynclib-devel0:3.1.7-1.el8_8.2
Red Hat rhel tus 8.8spausedd0:3.1.7-1.el8_8.2
Red Hat rhel tus 8.8spausedd-debuginfo0:3.1.7-1.el8_8.2
Rocky Linux 10corosync0:3.1.10-1.el10_2.2
Rocky Linux 8corosync0:3.1.8-1.el8_10.2
Rocky Linux 9corosync0:3.1.10-1.el9_8.2
SUSE Linux Enterprise High Availability Extension 12 SP5corosync2.3.6-9.25.1
SUSE Linux Enterprise High Availability Extension 15 SP4corosync2.4.6-150300.12.19.1
SUSE Linux Enterprise High Availability Extension 15 SP5corosync2.4.6-150300.12.19.1
SUSE Linux Enterprise High Availability Extension 15 SP6corosync2.4.6-150300.12.19.1
SUSE Linux Enterprise High Availability Extension 15 SP7corosync2.4.6-150300.12.19.1
SUSE Linux Enterprise High Availability Extension 16.0corosync3.1.9-160000.4.1
SUSE Linux Enterprise Server 12 SP5-LTSScorosync2.3.6-9.25.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5corosync2.3.6-9.25.1
Ubuntu 16.04 LTScorosyncno fix
Ubuntu 18.04 LTScorosyncno fix
Ubuntu 20.04 LTScorosyncno fix
Ubuntu 22.04 LTScorosyncno fix
Ubuntu 24.04 LTScorosyncno fix
Ubuntu 26.04 LTScorosyncno fix
Ubuntu 26.10corosyncno fix
openSUSE Leap 16.0corosync3.1.9-160000.4.1
openSUSE Tumbleweedcorosync3.1.10-5.1