# CVE-2026-81665: corosync: A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly

CVE-2026-81665 is fixed in 9 products on 1 platform, first by ALSA-2026:67872, released September 16, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-81665
- Priority: High
- CVSS: 7.5 (important)
- EPSS: 0.0042
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 4, 2026

## Description

A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | corosync RHEL 10 | 3.1.9-1.el10_0.3 | [RHSA-2026:67881](https://patchblox.com/security/data/fix/linux/rhsa-2026-67881.md) | Sep 17, 2026 |
| Linux | corosync RHEL 8 | 0:3.1.8-1.el8_10.2 | [RHSA-2026:69277](https://patchblox.com/security/data/fix/linux/rhsa-2026-69277.md) | Sep 22, 2026 |
| Linux | corosync RHEL 9 | 0:3.1.10-1.el9_8.2 | [RHSA-2026:67873](https://patchblox.com/security/data/fix/linux/rhsa-2026-67873.md) | Sep 19, 2026 |
| Linux | corosync almalinux 10 | 3.1.10-1.el10_2.2 | [ALSA-2026:67872](https://patchblox.com/security/data/fix/linux/alsa-2026-67872.md) | Sep 16, 2026 |
| Linux | corosync almalinux 8 | 3.1.8-1.el8_10.2 | [ALSA-2026:69277](https://patchblox.com/security/data/fix/linux/alsa-2026-69277.md) | Sep 21, 2026 |
| Linux | corosync almalinux 9 | 3.1.10-1.el9_8.2 | [ALSA-2026:67873](https://patchblox.com/security/data/fix/linux/alsa-2026-67873.md) | Sep 16, 2026 |
| Linux | corosync amzn 2023 | 3.1.9-3.amzn2023.0.3 | [ALAS2023-2026-3138](https://patchblox.com/security/data/fix/linux/alas2023-2026-3138.md) | Sep 28, 2026 |
| Linux | corosync ol 10 | 0:3.1.10-1.el10_2.2 | [ELSA-2026-67872](https://patchblox.com/security/data/fix/linux/elsa-2026-67872.md) | Sep 29, 2026 |
| Linux | corosync ol 8 | 0:3.1.8-1.el8_10.2 | [ELSA-2026-69277](https://patchblox.com/security/data/fix/linux/elsa-2026-69277.md) | Sep 23, 2026 |
| Linux | corosync ol 9 | 0:3.1.10-1.el9_8.2 | [ELSA-2026-67873](https://patchblox.com/security/data/fix/linux/elsa-2026-67873.md) | Sep 22, 2026 |
| Linux | corosync opensuse-leap 16.0 | 3.1.9-160000.4.1 | [OPENSUSE-SU-2026:21887-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21887-1.md) | Sep 20, 2026 |
| Linux | corosync rocky 10 | 0:3.1.10-1.el10_2.2 | [RLSA-2026:67872](https://patchblox.com/security/data/fix/linux/rlsa-2026-67872.md) | Sep 17, 2026 |
| Linux | corosync rocky 8 | 0:3.1.8-1.el8_10.2 | [RLSA-2026:69277](https://patchblox.com/security/data/fix/linux/rlsa-2026-69277.md) | Sep 23, 2026 |
| Linux | corosync rocky 9 | 0:3.1.10-1.el9_8.2 | [RLSA-2026:67873](https://patchblox.com/security/data/fix/linux/rlsa-2026-67873.md) | Sep 17, 2026 |
| Linux | corosync sles 15.6 | 2.4.6-150300.12.19.1 | [SUSE-SU-2026:4202-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4202-1.md) | Sep 16, 2026 |
| Linux | corosync sles 15.7 | 2.4.6-150300.12.19.1 | [SUSE-SU-2026:4202-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4202-1.md) | Sep 16, 2026 |
| Linux | corosync sles 16.0 | 3.1.9-160000.4.1 | [SUSE-SU-2026:23850-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23850-1.md) | Sep 20, 2026 |
| Linux | corosync-debuginfo amzn 2023 | 3.1.9-3.amzn2023.0.3 | [ALAS2023-2026-3138](https://patchblox.com/security/data/fix/linux/alas2023-2026-3138.md) | Sep 28, 2026 |
| Linux | corosync-debugsource amzn 2023 | 3.1.9-3.amzn2023.0.3 | [ALAS2023-2026-3138](https://patchblox.com/security/data/fix/linux/alas2023-2026-3138.md) | Sep 28, 2026 |
| Linux | corosync-vqsim RHEL 8 | 0:3.1.8-1.el8_10.2 | [RHSA-2026:69277](https://patchblox.com/security/data/fix/linux/rhsa-2026-69277.md) | Sep 22, 2026 |
| Linux | corosync-vqsim RHEL 9 | 0:3.1.10-1.el9_8.2 | [RHSA-2026:67873](https://patchblox.com/security/data/fix/linux/rhsa-2026-67873.md) | Sep 19, 2026 |
| Linux | corosync-vqsim almalinux 10 | 3.1.10-1.el10_2.2 | [ALSA-2026:67872](https://patchblox.com/security/data/fix/linux/alsa-2026-67872.md) | Sep 16, 2026 |
| Linux | corosync-vqsim almalinux 8 | 3.1.8-1.el8_10.2 | [ALSA-2026:69277](https://patchblox.com/security/data/fix/linux/alsa-2026-69277.md) | Sep 21, 2026 |
| Linux | corosync-vqsim almalinux 9 | 3.1.10-1.el9_8.2 | [ALSA-2026:67873](https://patchblox.com/security/data/fix/linux/alsa-2026-67873.md) | Sep 16, 2026 |
| Linux | corosync-vqsim amzn 2023 | 3.1.9-3.amzn2023.0.3 | [ALAS2023-2026-3138](https://patchblox.com/security/data/fix/linux/alas2023-2026-3138.md) | Sep 28, 2026 |
| Linux | corosync-vqsim ol 10 | 0:3.1.10-1.el10_2.2 | [ELSA-2026-67872](https://patchblox.com/security/data/fix/linux/elsa-2026-67872.md) | Sep 29, 2026 |
| Linux | corosync-vqsim ol 8 | 0:3.1.8-1.el8_10.2 | [ELSA-2026-69277](https://patchblox.com/security/data/fix/linux/elsa-2026-69277.md) | Sep 23, 2026 |
| Linux | corosync-vqsim ol 9 | 0:3.1.10-1.el9_8.2 | [ELSA-2026-67873](https://patchblox.com/security/data/fix/linux/elsa-2026-67873.md) | Sep 22, 2026 |
| Linux | corosync-vqsim-debuginfo amzn 2023 | 3.1.9-3.amzn2023.0.3 | [ALAS2023-2026-3138](https://patchblox.com/security/data/fix/linux/alas2023-2026-3138.md) | Sep 28, 2026 |
| Linux | corosynclib RHEL 8 | 0:3.1.8-1.el8_10.2 | [RHSA-2026:69277](https://patchblox.com/security/data/fix/linux/rhsa-2026-69277.md) | Sep 22, 2026 |
| Linux | corosynclib RHEL 9 | 0:3.1.10-1.el9_8.2 | [RHSA-2026:67873](https://patchblox.com/security/data/fix/linux/rhsa-2026-67873.md) | Sep 19, 2026 |
| Linux | corosynclib almalinux 10 | 3.1.10-1.el10_2.2 | [ALSA-2026:67872](https://patchblox.com/security/data/fix/linux/alsa-2026-67872.md) | Sep 16, 2026 |
| Linux | corosynclib almalinux 8 | 3.1.8-1.el8_10.2 | [ALSA-2026:69277](https://patchblox.com/security/data/fix/linux/alsa-2026-69277.md) | Sep 21, 2026 |
| Linux | corosynclib almalinux 9 | 3.1.10-1.el9_8.2 | [ALSA-2026:67873](https://patchblox.com/security/data/fix/linux/alsa-2026-67873.md) | Sep 16, 2026 |
| Linux | corosynclib amzn 2023 | 3.1.9-3.amzn2023.0.3 | [ALAS2023-2026-3138](https://patchblox.com/security/data/fix/linux/alas2023-2026-3138.md) | Sep 28, 2026 |
| Linux | corosynclib ol 10 | 0:3.1.10-1.el10_2.2 | [ELSA-2026-67872](https://patchblox.com/security/data/fix/linux/elsa-2026-67872.md) | Sep 29, 2026 |
| Linux | corosynclib ol 8 | 0:3.1.8-1.el8_10.2 | [ELSA-2026-69277](https://patchblox.com/security/data/fix/linux/elsa-2026-69277.md) | Sep 23, 2026 |
| Linux | corosynclib ol 9 | 0:3.1.10-1.el9_8.2 | [ELSA-2026-67873](https://patchblox.com/security/data/fix/linux/elsa-2026-67873.md) | Sep 22, 2026 |
| Linux | corosynclib-debuginfo amzn 2023 | 3.1.9-3.amzn2023.0.3 | [ALAS2023-2026-3138](https://patchblox.com/security/data/fix/linux/alas2023-2026-3138.md) | Sep 28, 2026 |
| Linux | corosynclib-devel RHEL 8 | 0:3.1.8-1.el8_10.2 | [RHSA-2026:69277](https://patchblox.com/security/data/fix/linux/rhsa-2026-69277.md) | Sep 22, 2026 |
| Linux | corosynclib-devel RHEL 9 | 0:3.1.10-1.el9_8.2 | [RHSA-2026:67873](https://patchblox.com/security/data/fix/linux/rhsa-2026-67873.md) | Sep 19, 2026 |
| Linux | corosynclib-devel almalinux 10 | 3.1.10-1.el10_2.2 | [ALSA-2026:67872](https://patchblox.com/security/data/fix/linux/alsa-2026-67872.md) | Sep 16, 2026 |
| Linux | corosynclib-devel almalinux 8 | 3.1.8-1.el8_10.2 | [ALSA-2026:69277](https://patchblox.com/security/data/fix/linux/alsa-2026-69277.md) | Sep 21, 2026 |
| Linux | corosynclib-devel almalinux 9 | 3.1.10-1.el9_8.2 | [ALSA-2026:67873](https://patchblox.com/security/data/fix/linux/alsa-2026-67873.md) | Sep 16, 2026 |
| Linux | corosynclib-devel amzn 2023 | 3.1.9-3.amzn2023.0.3 | [ALAS2023-2026-3138](https://patchblox.com/security/data/fix/linux/alas2023-2026-3138.md) | Sep 28, 2026 |
| Linux | spausedd RHEL 8 | 0:3.1.8-1.el8_10.2 | [RHSA-2026:69277](https://patchblox.com/security/data/fix/linux/rhsa-2026-69277.md) | Sep 22, 2026 |
| Linux | spausedd almalinux 8 | 3.1.8-1.el8_10.2 | [ALSA-2026:69277](https://patchblox.com/security/data/fix/linux/alsa-2026-69277.md) | Sep 21, 2026 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.