CVE-2026-35091 Details

A vulnerability exists in Corosync's membership commit token sanity check, specifically in the default totemudp/totemudpu mode. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted UDP packet, causing an out-of-bounds read. This exploitation leads to a denial-of-service condition and may disclose limited memory contents. The issue arises because the check_memb_commit_token_sanity function incorrectly validates message lengths, allowing truncated messages to be processed and causing a heap-buffer-overflow read, as confirmed by AddressSanitizer.

To mitigate this vulnerability, restrict network access to the Corosync service on UDP port 5405 to trusted hosts or networks. If Corosync is not needed, consider disabling the service. After making these changes, a restart of the Corosync service or a system reboot may be required for the changes to take effect.