All,
We are pleased to announce the general availability of kronosnet v1.35
kronosnet (or knet for short) is the new underlying network protocol for
Linux HA components (corosync), that features the ability to use
multiple links between nodes, active/active and active/passive link
failover policies, automatic link recovery, FIPS compliant encryption
(nss and/or openssl), automatic PMTUd and in general better performance
compared to the old network protocol.
Highlights in this release:
Security fixes:
- CVE-2026-15811 (LOW):
encryption key exposure in memory after cryptographic configuration
changes. Wipe cryptographic keys with explicit_bzero() before freeing
to prevent exposure through memory disclosure vulnerabilities.
https://bugzilla.redhat.com/show_bug.cgi?id=2500850
- CVE-2026-15812 (LOW):
access control list bypass via link ID spoofing on unencrypted dynamic
links. Validate source address against claimed link_id and enable ACL
by default.
https://bugzilla.redhat.com/show_bug.cgi?id=2500852
- CVE-2026-15813 (MEDIUM):
memory corruption and out-of-bounds access via malformed network
packet defragmentation. Validate fragment sequence numbers before
accessing defragmentation buffers.
https://bugzilla.redhat.com/show_bug.cgi?id=2500864
Other improvements:
- tests: add coverage for connected named AF_UNIX SOCK_STREAM sockets
- libnozzle: Introduce test macros similar to libknet
- docs: convert README to markdown format
Known issues in this release: None
Download: https://www.kronosnet.org/releases/
Upstream resources and contacts:
- https://kronosnet.org/
- https://github.com/kronosnet/kronosnet/
- https://ci.kronosnet.org/
- https://projects.clusterlabs.org/project/board/86/
- https://goo.gl/9ZvkLS
- IRC: #kronosnet on Libera
- https://lists.kronosnet.org/
Cheers,
The knet developer team
