Critical Corosync Vulnerabilities Discovered in Ubuntu and Fedora

Severity: High (Score: 70.5)

Sources: Linuxsecurity, launchpad.net, Ubuntu

Summary

Multiple vulnerabilities have been identified in the Corosync cluster engine, affecting Ubuntu 25.10, 24.04 LTS, and 22.04 LTS, as well as Fedora 42. The vulnerabilities include improper handling of membership commit token validity checks (CVE-2026-35091) and join message validation (CVE-2026-35092). A remote attacker could exploit these issues to crash Corosync, leading to denial of service, and potentially disclose sensitive information. The vulnerabilities were published on April 1, 2026, and have been addressed in recent updates. Users are advised to update their systems and restart Corosync to apply the patches. The affected versions of Corosync include 3.1.9-2ubuntu1.1 for Ubuntu 25.10 and 3.1.9-4 for Fedora. The updates are crucial for maintaining system integrity and availability. Key Points: • Corosync vulnerabilities CVE-2026-35091 and CVE-2026-35092 allow remote denial of service attacks. • Affected systems include Ubuntu 25.10, 24.04 LTS, 22.04 LTS, and Fedora 42. • Users must update their systems and restart Corosync to mitigate these vulnerabilities.

Key Entities

• Data Breach (attack_type)
• DDoS (attack_type)
• Denial of Service (attack_type)
• CVE-2026-35091 (cve)
• CVE-2026-35092 (cve)
• T1499 - Endpoint Denial of Service (mitre_attack)
• Corosync (platform)
• Ubuntu Pro (platform)
• Fedora (company)
• Ubuntu (company)