Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux Corosync may write beyond memory limits
published 1 month ago
Summary
The Corosync component used in AlmaLinux can accidentally write data outside its allocated memory area, which could cause crashes or allow malicious code to run. This happens because a safety check was missing in the code. Apply the latest Corosync update from AlmaLinux to install the fix that adds the proper bounds checking.
What to do
- Update almalinux corosync to version 3.1.7-1.el9.tuxcare.els3.
- Update almalinux corosync-vqsim to version 3.1.7-1.el9.tuxcare.els3.
- Update almalinux corosynclib to version 3.1.7-1.el9.tuxcare.els3.
- Update almalinux corosynclib-devel to version 3.1.7-1.el9.tuxcare.els3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.2 | almalinux | corosync |
< 3.1.7-1.el9.tuxcare.els3 Fix: upgrade to 3.1.7-1.el9.tuxcare.els3
|
| TuxCare:AlmaLinux:9.2 | almalinux | corosync-vqsim |
< 3.1.7-1.el9.tuxcare.els3 Fix: upgrade to 3.1.7-1.el9.tuxcare.els3
|
| TuxCare:AlmaLinux:9.2 | almalinux | corosynclib |
< 3.1.7-1.el9.tuxcare.els3 Fix: upgrade to 3.1.7-1.el9.tuxcare.els3
|
| TuxCare:AlmaLinux:9.2 | almalinux | corosynclib-devel |
< 3.1.7-1.el9.tuxcare.els3 Fix: upgrade to 3.1.7-1.el9.tuxcare.els3
|
Original advisory text
corosync: Fix of CVE-2026-81665
- CVE-2026-81665: fix out-of-bounds write in totempg_deliver_fn by replacing an
assert, compiled out in release builds, with a runtime bounds check
assert, compiled out in release builds, with a runtime bounds check
References
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1790352190.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-81665 Vendor Advisory
Timeline
Published25 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1790352190 · OSV
Track software like this
Free during beta