[ClusterLabs Developers] kronosnet v1.35 released (security fixes release)

[Fabio M. Di Nitto]

All,

We are pleased to announce the general availability of kronosnet v1.35

kronosnet (or knet for short) is the new underlying network protocol for 
Linux HA components (corosync), that features the ability to use 
multiple links between nodes, active/active and active/passive link 
failover policies, automatic link recovery, FIPS compliant encryption 
(nss and/or openssl), automatic PMTUd and in general better performance 
compared to the old network protocol.

Highlights in this release:

Security fixes:
- CVE-2026-15811 (LOW):
   encryption key exposure in memory after cryptographic configuration
   changes. Wipe cryptographic keys with explicit_bzero() before freeing
   to prevent exposure through memory disclosure vulnerabilities.
   https://bugzilla.redhat.com/show_bug.cgi?id=2500850

- CVE-2026-15812 (LOW):
   access control list bypass via link ID spoofing on unencrypted dynamic
   links. Validate source address against claimed link_id and enable ACL
   by default.
   https://bugzilla.redhat.com/show_bug.cgi?id=2500852

- CVE-2026-15813 (MEDIUM):
   memory corruption and out-of-bounds access via malformed network
   packet defragmentation. Validate fragment sequence numbers before
   accessing defragmentation buffers.
   https://bugzilla.redhat.com/show_bug.cgi?id=2500864

Other improvements:
- tests: add coverage for connected named AF_UNIX SOCK_STREAM sockets
- libnozzle: Introduce test macros similar to libknet
- docs: convert README to markdown format

Known issues in this release: None

Download: https://www.kronosnet.org/releases/

Upstream resources and contacts:
- https://kronosnet.org/
- https://github.com/kronosnet/kronosnet/
- https://ci.kronosnet.org/
- https://projects.clusterlabs.org/project/board/86/
- https://goo.gl/9ZvkLS
- IRC: #kronosnet on Libera
- https://lists.kronosnet.org/

Cheers,
The knet developer team