Loading story…
Red Hat disclosed CVE-2026-10649, an Important-severity flaw in Pacemaker that can let an unauthenticated remote attacker crash the service by sending a crafted compressed message to the CIB remote listener. The bug is an integer overflow in remote message decompression in lib/common/remote.c, specifically pcmk__remote_message_xml(), where attacker-controlled header fields are used in size calculations before allocation, creating a pre-authentication path to memory corruption and denial of service. The issue is reachable over the network when remote-port or remote-tls-port is enabled; in TLS deployments, an attacker must first complete the GnuTLS handshake.
ClusterLabs published upstream fixes in pull request #4128, adding stricter header validation, overflow-safe arithmetic, corrected size checks, clearer error handling, and a 20 MB cap on remote message size to prevent crashes, memory corruption, and unbounded memory allocation that could also contribute to node fencing. Maintainers noted Pacemaker has not used its remote message compression code since it was introduced in 2013, which may explain why the defect went unnoticed. Until patched builds are deployed, defenders are advised to disable the CIB remote listener if it is not needed or restrict access to trusted peers only.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat Product Security disclosed CVE-2026-10649 on the oss-sec mailing list, describing an Important-severity Pacemaker flaw that allows unauthenticated remote denial of service through integer overflow in pre-auth remote message decompression. The advisory included a CVSS 8.6 score, noted the affected code path, and pointed to upstream patches in pull request #4128.
ClusterLabs published pull request #4128 with fixes for integer overflows, size validation issues, and unbounded memory allocation in Pacemaker's remote message handling code. The changes added safer arithmetic and validation checks and imposed a 20 MB maximum remote message size.
A Red Hat Bugzilla report described CVE-2026-10649, a high-severity integer overflow in Pacemaker's remote message decompression that could let an unauthenticated network attacker cause memory corruption and denial of service via the CIB remote listener. The report said no released fix was established at that time and upstream had not yet been notified.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcegithub.com
Open sourceopenwall.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-45934** is an integer-overflow flaw in the Linux kernel Bluetooth L2CAP configuration-request handler, `l2cap_config_req()` in `net/bluetooth/l2cap_core.c`. A local or Bluetooth-adjacent attacker can repeatedly send crafted `L2CAP_CONF_REQ` packets until the unsigned 8-bit `chan->num_conf_rsp` counter wraps after 255 responses, potentially disrupting Bluetooth communications or crashing the affected system. Red Hat rates the issue Moderate with a CVSS 3.1 score of 6.5; NVD and CVE.org list 7.8. Upstream commit `ae4569813a6e931258db627cdfe50dfb4f917d5d` prevents the wraparound by limiting counter increments to `L2CAP_CONF_MAX_CONF_RSP`. Red Hat shipped fixes for affected RHEL 8 and RHEL 9 kernel packages in RHSA-2024:2394, RHSA-2024:2950, and RHSA-2024:3138, while RHEL 9 `kernel-rt` remained affected and RHEL 6/7 were outside support scope. Organizations unable to patch can reduce exposure by disabling Bluetooth through kernel-module blocklisting, hardware controls, or BIOS settings.
Aug 26, 2026
**CVE-2024-41009** is an out-of-bounds memory-access flaw in the Linux kernel BPF ring-buffer implementation. A privileged local attacker can manipulate the consumer position and the ring buffer's double-mapped circular layout to obtain overlapping record reservations, then alter an earlier record header so that `bpf_ringbuf_commit()` accesses an incorrect page, potentially crashing the kernel. The weakness is associated with CWE-121, stack-based buffer overflow, and affects the handling of outstanding BPF ring-buffer records. The upstream fix tracks the oldest pending record position and rejects reservations when the range of outstanding records would exceed the ring-buffer size. Red Hat rates the issue **Moderate** (CVSS 3.1: 4.4), requiring local high privileges and primarily enabling denial of service; NVD assigns 5.5, while CVE.org reports 7.8 with confidentiality and integrity impacts. Red Hat issued kernel updates for multiple RHEL 8 and RHEL 9 streams, including extended-support variants, and reports no qualifying mitigation beyond applying the updates.
Aug 26, 2026
Red Hat has documented multiple **CWE-772** resource-management flaws that can exhaust memory or device references and cause denial of service. In the Linux kernel, `CVE-2022-50269` leaks a configuration object if VKMS initialization fails; `CVE-2022-50318` leaks PCI-device references in Intel uncore performance-monitoring code; and `CVE-2022-50372` leaks a CIFS/SMB session-setup request when NTLMSSP negotiate-blob construction fails. Each kernel issue is rated CVSS 5.5 and requires local, low-privileged access to trigger resource exhaustion. Fixes are available for affected RHEL kernel packages, including RHEL 8 for the CIFS issue under **RHSA-2024:5101**, while some RHEL 9 and real-time kernel fixes remain deferred; unsupported branches are generally unaffected where the vulnerable code is absent. Separately, `CVE-2024-2398` affects curl/libcurl HTTP/2 server-push handling: a remote server can repeatedly send oversized pushed headers and cause leaked header memory when libcurl aborts the push. Rated CVSS 7.5, that flaw was fixed for affected JBoss Core Services HTTPD 2.4 components on RHEL 7 and 8 in **RHSA-2024:2693**.
Aug 27, 2026