Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-111
Advisory Release Date: 2026-10-12 09:00 Pacific
Advisory Updated Date: 2026-10-12 09:00 Pacific
Severity:
Important
Issue Overview:
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control. (CVE-2026-81665)
Affected Packages:
corosync
Issue Correction:
Run yum update corosync to update your system.
New Packages:
aarch64:
corosync-vqsim-debuginfo-3.1.10-8.amzn2027.0.1.aarch64
corosync-vqsim-3.1.10-8.amzn2027.0.1.aarch64
corosync-debugsource-3.1.10-8.amzn2027.0.1.aarch64
corosynclib-debuginfo-3.1.10-8.amzn2027.0.1.aarch64
corosync-debuginfo-3.1.10-8.amzn2027.0.1.aarch64
corosynclib-3.1.10-8.amzn2027.0.1.aarch64
corosync-3.1.10-8.amzn2027.0.1.aarch64
corosynclib-devel-3.1.10-8.amzn2027.0.1.aarch64
src:
corosync-3.1.10-8.amzn2027.0.1.src
x86_64:
corosynclib-debuginfo-3.1.10-8.amzn2027.0.1.x86_64
corosynclib-devel-3.1.10-8.amzn2027.0.1.x86_64
corosync-vqsim-debuginfo-3.1.10-8.amzn2027.0.1.x86_64
corosync-debuginfo-3.1.10-8.amzn2027.0.1.x86_64
corosync-debugsource-3.1.10-8.amzn2027.0.1.x86_64
corosync-vqsim-3.1.10-8.amzn2027.0.1.x86_64
corosynclib-3.1.10-8.amzn2027.0.1.x86_64
corosync-3.1.10-8.amzn2027.0.1.x86_64