Skip to content
OpenAdvisories
Medium · 5.1 CVE-2026-114038 EUVD-2026-106990GHSA-7rmr-p966-7g82

Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string

Published Oct 21, 2026 · Updated Nov 5, 2026 · Assigned by redhat

Description

A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat OpenShift Container Platform 4 — —
Red Hat Red Hat OpenShift Container Platform 5 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 multipath-tools 0.15.1-1 —
Debian 13 multipath-tools No fix yet —
Debian 12 multipath-tools No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 multipath-tools No fix yet —
Ubuntu 26.04 LTS multipath-tools No fix yet —
Ubuntu 24.04 LTS multipath-tools No fix yet —
Ubuntu 22.04 LTS multipath-tools No fix yet —
Ubuntu 20.04 LTS multipath-tools No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS multipath-tools No fix yet —
Ubuntu 16.04 LTS multipath-tools No fix yet —
Ubuntu 14.04 LTS multipath-tools No fix yet —

References