Executive brief
A vulnerability in multipathd, a system daemon that manages storage path redundancy, allows a local attacker to block communication with the daemon by exploiting its IPC socket. An attacker can cause legitimate storage management commands to hang or time out, disrupting system operations and potentially affecting storage failover and data availability, though not allowing data theft or system compromise.
Technical details
The vulnerability is a denial-of-service flaw (CWE-1322: blocking code in non-blocking context) in multipathd's listener thread. A local attacker with access to the multipathd UNIX control socket can send valid commands and then stop reading replies, causing the listener thread to block indefinitely. This prevents legitimate IPC operations from completing. The attack requires local access to the control socket and no elevated privileges, but does not result in privilege escalation, code execution, or data confidentiality/integrity impact. Red Hat has released a fix; exploitation in the wild has not been reported.
Affected products
- Red Hat device-mapper-multipath multipathd component
Timeline
- 2026-09-11: disclosed