CVE catalog
CVE-2026-114038
multipath-tools: CVE-2026-114038
- Severity
- Medium · CVSS 5.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.12% · Oct 25, 2026
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | multipath-tools | sid | 0.15.1-1 | fixed |
| Debian | multipath-tools | forky | 0.15.1-1 | fixed |
| Debian | multipath-tools | trixie | 0.11.1-2 | vulnerable |
| Debian | multipath-tools | bookworm | 0.9.4-3+deb12u2 | vulnerable |
| Ubuntu | multipath-tools | 14.04 | 0.4.9-3ubuntu7 | vulnerable |
| Ubuntu | multipath-tools | 14.04 | 0.4.9-3ubuntu7.2 | vulnerable |
| Ubuntu | multipath-tools | 14.04 | 0.4.9-3ubuntu7.4 | vulnerable |
| Ubuntu | multipath-tools | 14.04 | 0.4.9-3ubuntu7.6 | vulnerable |
| Ubuntu | multipath-tools | 14.04 | 0.4.9-3ubuntu7.7 | vulnerable |
| Ubuntu | multipath-tools | 14.04 | 0.4.9-3ubuntu7.9 | vulnerable |
| Ubuntu | multipath-tools | 14.04 | 0.4.9-3ubuntu7.11 | vulnerable |
| Ubuntu | multipath-tools | 14.04 | 0.4.9-3ubuntu7.12 | vulnerable |
| Ubuntu | multipath-tools | 14.04 | 0.4.9-3ubuntu7.13 | vulnerable |
| Ubuntu | multipath-tools | 14.04 | 0.4.9-3ubuntu7.14 | vulnerable |
| Ubuntu | multipath-tools | 14.04 | 0.4.9-3ubuntu7.15 | vulnerable |
| Ubuntu | multipath-tools | 14.04 | 0.4.9-3ubuntu7.16 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0-7ubuntu7 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0-7ubuntu8 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0-7ubuntu9 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0-7ubuntu10 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0-7ubuntu11 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0-7ubuntu12 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0-7ubuntu14 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0-7ubuntu15 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0-7ubuntu16 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0+git1.656f8865-5ubuntu1 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0+git1.656f8865-5ubuntu2 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0+git1.656f8865-5ubuntu2.1 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0+git1.656f8865-5ubuntu2.2 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0+git1.656f8865-5ubuntu2.3 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0+git1.656f8865-5ubuntu2.4 | vulnerable |
| Ubuntu | multipath-tools | 16.04 | 0.5.0+git1.656f8865-5ubuntu2.5 | vulnerable |
| Ubuntu | multipath-tools | 18.04 | 0.6.4-5ubuntu1 | vulnerable |
| Ubuntu | multipath-tools | 18.04 | 0.7.4-2ubuntu1 | vulnerable |
| Ubuntu | multipath-tools | 18.04 | 0.7.4-2ubuntu3 | vulnerable |
| Ubuntu | multipath-tools | 18.04 | 0.7.4-2ubuntu3.1 | vulnerable |
| Ubuntu | multipath-tools | 18.04 | 0.7.4-2ubuntu3.2 | vulnerable |
| Ubuntu | multipath-tools | 20.04 | 0.7.9-3ubuntu6 | vulnerable |
| Ubuntu | multipath-tools | 20.04 | 0.7.9-3ubuntu7 | vulnerable |
| Ubuntu | multipath-tools | 20.04 | 0.8.3-1ubuntu1 | vulnerable |
| Ubuntu | multipath-tools | 20.04 | 0.8.3-1ubuntu2 | vulnerable |
| Ubuntu | multipath-tools | 20.04 | 0.8.3-1ubuntu2.1 | vulnerable |
| Ubuntu | multipath-tools | 20.04 | 0.8.3-1ubuntu2.2 | vulnerable |
| Ubuntu | multipath-tools | 20.04 | 0.8.3-1ubuntu2.3 | vulnerable |
| Ubuntu | multipath-tools | 20.04 | 0.8.3-1ubuntu2.4 | vulnerable |
| Ubuntu | multipath-tools | 22.04 | 0.8.5-2ubuntu2 | vulnerable |
| Ubuntu | multipath-tools | 22.04 | 0.8.5-2ubuntu3 | vulnerable |
| Ubuntu | multipath-tools | 22.04 | 0.8.8-1ubuntu1 | vulnerable |
| Ubuntu | multipath-tools | 22.04 | 0.8.8-1ubuntu1.22.04.1 | vulnerable |
| Ubuntu | multipath-tools | 22.04 | 0.8.8-1ubuntu1.22.04.3 | vulnerable |
| Ubuntu | multipath-tools | 22.04 | 0.8.8-1ubuntu1.22.04.4 | vulnerable |
| Ubuntu | multipath-tools | 24.04 | 0.9.4-5ubuntu3 | vulnerable |
| Ubuntu | multipath-tools | 24.04 | 0.9.4-5ubuntu6 | vulnerable |
| Ubuntu | multipath-tools | 24.04 | 0.9.4-5ubuntu7 | vulnerable |
| Ubuntu | multipath-tools | 24.04 | 0.9.4-5ubuntu8 | vulnerable |
| Ubuntu | multipath-tools | 24.04 | 0.9.4-5ubuntu8.1 | vulnerable |
| Ubuntu | multipath-tools | 24.04 | 0.9.4-5ubuntu8.2 | vulnerable |
| Ubuntu | multipath-tools | 26.10 | 0.14.3-2ubuntu1 | vulnerable |
| Ubuntu | multipath-tools | 26.10 | 0.14.3-3ubuntu1 | vulnerable |
| Ubuntu | multipath-tools | 26.10 | 0.14.3-3ubuntu2 | vulnerable |
| Ubuntu | multipath-tools | 26.04 | 0.11.1-3ubuntu2 | vulnerable |
| Ubuntu | multipath-tools | 26.04 | 0.12.0-1ubuntu1 | vulnerable |
| Ubuntu | multipath-tools | 26.04 | 0.12.0-1ubuntu2 | vulnerable |
| Ubuntu | multipath-tools | 26.04 | 0.12.0-1ubuntu3 | vulnerable |
| Ubuntu | multipath-tools | 26.04 | 0.14.3-2ubuntu1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | multipath-tools | source | sid | 0.15.1-1 | not yet assigned | Not reported | Not reported |
| Debian | multipath-tools | source | forky | 0.15.1-1 | not yet assigned | Not reported | Not reported |
| Debian | multipath-tools | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | multipath-tools | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [kpartx]Affected
Source package: [multipath-tools]
Details (2)
0.9.4-3+deb12u2· amd64 · bookwormAffected
dsa · multipath-tools · debian · bookworm; dsa · multipath-tools · debian · 12
0.9.4-3+deb12u2· arm64 · bookwormAffected
dsa · multipath-tools · debian · bookworm; dsa · multipath-tools · debian · 12
- [multipath-tools]Affected
Details (2)
0.9.4-3+deb12u2· amd64 · bookwormAffected
dsa · multipath-tools · debian · bookworm; dsa · multipath-tools · debian · 12
0.9.4-3+deb12u2· arm64 · bookwormAffected
dsa · multipath-tools · debian · bookworm; dsa · multipath-tools · debian · 12
- [multipath-tools-boot]Affected
Source package: [multipath-tools]
Details (2)
0.9.4-3+deb12u2· all · bookwormAffected
dsa · multipath-tools · debian · bookworm; dsa · multipath-tools · debian · 12
0.9.4-3+deb12u2· all · bookwormAffected
dsa · multipath-tools · debian · bookworm; dsa · multipath-tools · debian · 12
[Debian 13 (Trixie)]
- [kpartx]Affected
Source package: [multipath-tools]
Details (2)
0.11.1-2· amd64 · trixieAffected
dsa · multipath-tools · debian · 13
0.11.1-2· arm64 · trixieAffected
dsa · multipath-tools · debian · 13
- [multipath-tools]Affected
Details (2)
0.11.1-2· amd64 · trixieAffected
dsa · multipath-tools · debian · 13
0.11.1-2· arm64 · trixieAffected
dsa · multipath-tools · debian · 13
- [multipath-tools-boot]Affected
Source package: [multipath-tools]
Details (2)
0.11.1-2· all · trixieAffected
dsa · multipath-tools · debian · 13
0.11.1-2· all · trixieAffected
dsa · multipath-tools · debian · 13
Observed:
References
- [https://access.redhat.com/security/cve/CVE-2026-114038]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2469787]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-114038]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-114038]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-114038]
- [https://security-tracker.debian.org/tracker/CVE-2026-114038]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114038.json]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]