CVE-2026-89329
Device-mapper-multipath: local denial of service via blocking ipc send operations
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Device-mapper-multipath: local denial of service via blocking ipc send operations
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.
- Record
CVE-2026-89329- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1322
- Updated
- 2026-11-06
EUVDEUVD-2026-76186
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.
- Record
EUVD-2026-76186- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-gm43-73c3-chhw
A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control...
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.
- Record
GHSA-gm43-73c3-chhw- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1322
- Updated
- 2026-11-02
NVD
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.
- Record
CVE-2026-89329- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1322
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-89329
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.
- Record
DEBIAN-CVE-2026-89329- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-4156
multipath-tools security update
This package provides the multipath tool and the multipathd daemon to manage dm-multipath devices. multipath can detect and set up multipath maps. multipathd sets up multipath maps automatically, monitors path devices for failure, removal, or addition, and applies the necessary changes to the multipath maps to ensure continuous availability of the map devices.
Security Fix(es):
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.(CVE-2026-89329)
- Record
OESA-2026-4156- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVOESA-2026-4157
multipath-tools security update
This package provides the multipath tool and the multipathd daemon to manage dm-multipath devices. multipath can detect and set up multipath maps. multipathd sets up multipath maps automatically, monitors path devices for failure, removal, or addition, and applies the necessary changes to the multipath maps to ensure continuous availability of the map devices.
Security Fix(es):
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.(CVE-2026-89329)
- Record
OESA-2026-4157- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-4158
multipath-tools security update
This package provides the multipath tool and the multipathd daemon to manage dm-multipath devices. multipath can detect and set up multipath maps. multipathd sets up multipath maps automatically, monitors path devices for failure, removal, or addition, and applies the necessary changes to the multipath maps to ensure continuous availability of the map devices.
Security Fix(es):
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.(CVE-2026-89329)
- Record
OESA-2026-4158- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-4159
multipath-tools security update
This package provides the multipath tool and the multipathd daemon to manage dm-multipath devices. multipath can detect and set up multipath maps. multipathd sets up multipath maps automatically, monitors path devices for failure, removal, or addition, and applies the necessary changes to the multipath maps to ensure continuous availability of the map devices.
Security Fix(es):
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.(CVE-2026-89329)
- Record
OESA-2026-4159- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-89329
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.
- Record
UBUNTU-CVE-2026-89329- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-101727 No score
CVE-2026-89329 affecting package device-mapper-multipath 0.9.6-1
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.
- Record
AZL-101727- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
device-mapper-multipathAzure Linux:3 |
through 0.9.6-1 | None known |
multipath-toolsDebian:12 |
All versions, plus listed versions 0.10.0-10.11.1-10.11.1-20.11.1-30.11.1-4 Show 26 moreShow less0.12.0-10.13.0-10.14.3-10.14.3-20.14.3-30.14.3-40.15.0-10.15.1-10.9.4-100.9.4-30.9.4-3+deb12u10.9.4-3+deb12u20.9.4-40.9.4-50.9.4-60.9.4-70.9.4-80.9.4-90.9.7-10.9.7-20.9.7-30.9.7-40.9.7-60.9.7-70.9.8-10.9.9-1 |
None known |
multipath-toolsDebian:13 |
All versions, plus listed versions 0.11.1-20.11.1-30.11.1-40.12.0-10.13.0-1 Show 6 moreShow less0.14.3-10.14.3-20.14.3-30.14.3-40.15.0-10.15.1-1 |
None known |
multipath-toolsDebian:14 |
All versions, plus listed versions 0.11.1-20.11.1-30.11.1-40.12.0-10.13.0-1 Show 6 moreShow less0.14.3-10.14.3-20.14.3-30.14.3-40.15.0-10.15.1-1 |
None known |
multipath-toolsopenEuler:24.03-LTS-SP3 |
before 0.9.5-21.oe2403sp3 | 0.9.5-21.oe2403sp3 |
multipath-toolsopenEuler:24.03-LTS-SP4 |
before 0.9.5-21.oe2403sp4 | 0.9.5-21.oe2403sp4 |
multipath-toolsopenEuler:22.03-LTS-SP4 |
before 0.8.7-29.oe2203sp4 | 0.8.7-29.oe2203sp4 |
multipath-toolsopenEuler:24.03-LTS-SP1 |
before 0.9.5-21.oe2403sp1 | 0.9.5-21.oe2403sp1 |
multipath-toolsUbuntu:14.04:LTS |
All versions, plus listed versions 0.4.9-3ubuntu70.4.9-3ubuntu7.20.4.9-3ubuntu7.40.4.9-3ubuntu7.60.4.9-3ubuntu7.7 Show 7 moreShow less0.4.9-3ubuntu7.90.4.9-3ubuntu7.110.4.9-3ubuntu7.120.4.9-3ubuntu7.130.4.9-3ubuntu7.140.4.9-3ubuntu7.150.4.9-3ubuntu7.16 |
None known |
multipath-toolsUbuntu:16.04:LTS |
All versions, plus listed versions 0.5.0-7ubuntu70.5.0-7ubuntu80.5.0-7ubuntu90.5.0-7ubuntu100.5.0-7ubuntu11 Show 11 moreShow less0.5.0-7ubuntu120.5.0-7ubuntu140.5.0-7ubuntu150.5.0-7ubuntu160.5.0+git1.656f8865-5ubuntu10.5.0+git1.656f8865-5ubuntu20.5.0+git1.656f8865-5ubuntu2.10.5.0+git1.656f8865-5ubuntu2.20.5.0+git1.656f8865-5ubuntu2.30.5.0+git1.656f8865-5ubuntu2.40.5.0+git1.656f8865-5ubuntu2.5 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
multipath-toolsUbuntu:18.04:LTS |
All versions, plus listed versions 0.6.4-5ubuntu10.7.4-2ubuntu10.7.4-2ubuntu30.7.4-2ubuntu3.10.7.4-2ubuntu3.2 |
None known |
multipath-toolsUbuntu:20.04:LTS |
All versions, plus listed versions 0.7.9-3ubuntu60.7.9-3ubuntu70.8.3-1ubuntu10.8.3-1ubuntu20.8.3-1ubuntu2.10.8.3-1ubuntu2.20.8.3-1ubuntu2.30.8.3-1ubuntu2.4 |
None known |
multipath-toolsUbuntu:22.04:LTS |
All versions, plus listed versions 0.8.5-2ubuntu20.8.5-2ubuntu30.8.8-1ubuntu10.8.8-1ubuntu1.22.04.10.8.8-1ubuntu1.22.04.30.8.8-1ubuntu1.22.04.4 |
None known |
multipath-toolsUbuntu:24.04:LTS |
All versions, plus listed versions 0.9.4-5ubuntu30.9.4-5ubuntu60.9.4-5ubuntu70.9.4-5ubuntu80.9.4-5ubuntu8.10.9.4-5ubuntu8.2 |
None known |
multipath-toolsUbuntu:26.10 |
All versions, plus listed versions 0.14.3-2ubuntu10.14.3-3ubuntu10.14.3-3ubuntu2 |
None known |
multipath-toolsUbuntu:26.04:LTS |
All versions, plus listed versions 0.11.1-3ubuntu20.12.0-1ubuntu10.12.0-1ubuntu20.12.0-1ubuntu30.14.3-2ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| products | CVE List, EUVD | |
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-89329 is a medium vulnerability (CVSS 6.2) in Red Hat Enterprise Linux 10, published September 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in multipath-tools 0.9.5-21.oe2403sp3.
References
access.redhat.com/security/cve/CVE-2026-89329
bugzilla.redhat.com/show_bug.cgi?id=2470013
nvd.nist.gov/vuln/detail/CVE-2026-89329
github.com/advisories/GHSA-gm43-73c3-chhw
security-tracker.debian.org/tracker/CVE-2026-89329
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4156
Show 6 moreShow less
ubuntu.com/security/CVE-2026-89329
cve.org/CVERecord?id=CVE-2026-89329