CVE-2026-89329

NameCVE-2026-89329
DescriptionA flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the `multipathd` listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
multipath-tools (PTS)bookworm0.9.4-3+deb12u2vulnerable
trixie0.11.1-2vulnerable
forky, sid0.15.0-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
multipath-toolssource(unstable)(unfixed)

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2470013
https://github.com/opensvc/multipath-tools/security/advisories/GHSA-hmcm-9cq4-r2xm

Search for package or bug name: Reporting problems