Integer Overflow Vulnerability in Oracle Linux Pacemaker Affects Multiple Versions

Oracle has released security advisories for Oracle Linux 8 and 9 addressing a critical integer overflow vulnerability (CVE-2026-10649) in the Pacemaker software. This vulnerability allows for potential remote code execution through message decompression, affecting systems running specific versions of Pacemaker. The flaw could lead to privilege escalation and system-wide damage if exploited. Users are urged to audit Linux privileges to limit the risk of compromise and escalation. The vulnerability was published on June 16, 2026, and has been linked to upstream references in the pacemaker crm_report binary. Immediate action is recommended to mitigate risks associated with this vulnerability. The advisories provide specific package updates for affected systems.

Key Points: • CVE-2026-10649 is a critical integer overflow vulnerability in Oracle Linux Pacemaker. • Affected versions include Oracle Linux 8 and 9, with potential for remote code execution. • Users are advised to audit privileges and apply the latest patches to mitigate risks.