CVE-2026-89329 Device-mapper-multipath: local denial of service via blocking ipc send operations
A local attacker can cause a denial of service in multipathd by blocking IPC replies, affecting Red Hat Enterprise Linux and related distributions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89329?
CVE-2026-89329 is a medium-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the `multipathd` listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.
Weakness: CWE-1322
Which versions are affected by CVE-2026-89329?
How do I fix CVE-2026-89329?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89329 being exploited?
There is no known exploitation of CVE-2026-89329 in the wild and no public exploit code.
Sources
Also known as AZL-101727, DEBIAN-CVE-2026-89329, GHSA-gm43-73c3-chhw, OESA-2026-4156, OESA-2026-4157, OESA-2026-4158 and 2 more.