OESA-2026-4717: multipath-tools security update
This package provides the multipath tool and the multipathd daemon to manage dm-multipath devices. multipath can detect and set up multipath maps. multipathd sets up multipath maps automatically, monitors path devices for failure, removal, or addition, and applies the necessary changes to the multipath maps to ensure continuous availability of the map devices. Security Fix(es):
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).(CVE-2026-114038)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/multipath-toolsto a version that resolves this vulnerability.Fixed in 0.9.5-22.oe2403sp3
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker needs local access to the system and must be able to send a command to the multipath daemon. No privileges or user interaction are identified as required.
What could successful exploitation cause?
A crafted command whose format string ends with a trailing percent character can trigger an out-of-bounds read. This may disclose unintended multipathd memory or crash the daemon, causing denial of service.