OESA-2026-4716: multipath-tools security update
This package provides the multipath tool and the multipathd daemon to manage dm-multipath devices. multipath can detect and set up multipath maps. multipathd sets up multipath maps automatically, monitors path devices for failure, removal, or addition, and applies the necessary changes to the multipath maps to ensure continuous availability of the map devices. Security Fix(es):
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).(CVE-2026-114038)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/multipath-toolsto a version that resolves this vulnerability.Fixed in 0.9.5-22.oe2403sp1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the multipathd daemon are exposed to a local user who can send it a command. The issue affects device-mapper-multipath functionality managed by multipath-tools.
What does an attacker need to do to exploit it?
An attacker needs local access and must send multipathd a command whose format string ends with a trailing percent character. No privileges or user interaction are indicated by the supplied severity vector.
What is the impact of successful exploitation?
Successful exploitation can disclose unintended memory from the multipath daemon or crash the daemon. A crash can disrupt multipath map management and cause a denial of service.