SUSE · Security update for multipath-tools
Affects SUSESource GCVE Database
Fixed in SUSE package updates : update SUSE when convenient.
Data as of 26 Oct 2026, 16:19 UTC
Rated by Threat Radar
- Patch
- Available – fixed in 0.12.4
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| SUSE Product Security Team SUSE | Affected
| Fixed in– |
AI-suggested
Upgrade multipath-tools to version 0.12.4+278+suse.9cf9c5c or later, which includes fixes for all listed vulnerabilities. No additional mitigation is indicated beyond applying this security update.
Description
This security update for multipath-tools addresses multiple vulnerabilities including heap out-of-bounds reads, path traversal, heap buffer overflows, local denial of service, and socket exhaustion. The update fixes issues in custom format string parsing, device-mapper-multipath failed_wwids management, SCSI PRIN READ FULL STATUS responses, IPC send operations, GPT header validation, and ALUA RTPG parsing. The update also adds a missing NULL check in the DM parser. These vulnerabilities could lead to information disclosure, denial of service, or memory corruption.
References
- suse.com/support/security/rating/ (opens in a new tab)
- ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21802-1.json (opens in a new tab)
- bugzilla.suse.com/1277199 (opens in a new tab)
- bugzilla.suse.com/1277203 (opens in a new tab)
- bugzilla.suse.com/1277205 (opens in a new tab)
- bugzilla.suse.com/1277208 (opens in a new tab)
- bugzilla.suse.com/1277209 (opens in a new tab)
- bugzilla.suse.com/1277210 (opens in a new tab)
- bugzilla.suse.com/1277212 (opens in a new tab)