# SUSE-SU-2026:23054-1: Security update for multipath-tools > Integer overflow and missing bounds checks in kpartx allow heap out-of-bounds reads and unbounded writes via crafted USB or DASD devices, potentially leading to code execution or crashes. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Local or same network only - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 6 Aug 2026 ## What is SUSE-SU-2026:23054-1? SUSE-SU-2026:23054-1 is a vulnerability in multipath-tools, published on 6 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link. ### Official description This update for multipath-tools fixes the following issues: Update to version 0.9.8+292+suse.c0523c1. Security issues fixed: - kpartx: integer overflow in the GPT partition table size calculation can lead to heap OOB read via crafted USB device or disk image(bsc#1268145). - kpartx: missing bounds check can lead to a DASD VOL1 unbounded array write via a crafted DASD disk with more than 256 consecutive format labels (bsc#1268144). Other updates and bugfixes: - [Build 32.2] System with multipath fails to boot during first boot during the installation (bsc#1232063). - [Build 50.1] multipath btrfs i/o error on both Leap 15.6 and SLES 15 SP6 (bsc#1219289). - Fix code that leads to `is_bit_set_in_bitfield: bitfield overflow: 1 >= 0` message showing up in syslog (bsc#1255285). - Version 0.9.8+266+suse.53479977 (bsc#1257007): * kpartx: fix segfault when operating on regular files (bsc#1257244, bsc#1257153) * multipathd: print path offline message even without a checker (bsc#1254094) * Fix command descriptions in the multipathd man page. * Fix ISO C23 compatibility issue causing errors with new compilers. * Fix memory leak caused by not joining the "init unwinder" thread. * Fix memory leaks in kpartx. * Print the warning "setting scsi timeouts is unsupported for protocol" only once per protocol. * Make sure multipath-tools is compiled with the compiler flag `-fno-strict-aliasing`. (gh#opensvc/multipath-tools#130, bsc#1255285) - Version 0.9.8+247+suse.863ae86f: * Log offline path state if "log_checker_err always" is set - Version 0.9.8+246+suse.fb81edd2: * CI: GitHub workflow updates. No code changes. - Version 0.9.8+166+suse.95399ce1: - Backported fixes from upstream 0.9.9 ... 0.10.5 (bsc#1253260) * Updates to the built-in hardware table: - add some NVMe storage array (VASTData, Infinidat, HITACHI VSP) - add QSAN - add EqualLogic PS - Add Quantum devices - Enable ALUA for AStor/NeoSapphire - Update NFINIDAT/InfiniBox config - Fix product blacklist of S/390 devices - Add Seagate Lyve - Add HITACHI VSP One SDS Block - Add SCST (SCSI Target Subsystem for Linux) - Huawei storage arrays - XSG1 vendors * Avoid a possible system hang during shutdown with queueing multipath maps. * Failed paths should be checked every `polling_interval`. In certain cases, this wouldn't happen, because the check interval wasn't reset by multipathd. * It could happen that multipathd would accidentally release a SCSI persistent reservation held by another node. Fix it. * After manually failing some paths and then reinstating them, sometimes the reinstated paths were immediately failed again by multipathd. * Fixed the problem that, if there were multiple maps with deferred failback (`failback` value > 0 in `multipath.conf`), some maps might fail back later than configured. * Fixed a problem in the marginal path detection algorithm that could cause the io error check for a recently failed path to be delayed. * Fixed a minor bug in the config file parser * Fixed minor issues detected by coverity. - Version 0.9.8+111+suse.b7ee850: - Backported bug fixes from upstream 0.9.9 - 0.10.2 * Fixed old mpathpersist bug leading to the error message "configured reservation key doesn't match: 0x0" when `reservation_key` was configured in the multipaths section of `multipath.conf`. (bsc#1228926, gh#opensvc/multipath-tools#92) * Fixed bug that caused queueing to be always disabled if flushing a map failed (bug introduced in 0.9.8). (bsc#1229898) * Fixed output of `multipath -t` and `multipath -T` for the options `force_sync` and `retrigger_tries`. (bsc#1229898, gh#opensvc/multipath-tools#88) * libmultipath: don't print error message if WATCHDOG_USEC is 0 (bsc#1232227) * Fix map failure count for no_path_retry > 0 (bsc#1229898) * Fix reboot hang if uevent is processed for suspended device (bsc#1232063) * libmultipath: don't set dev_loss_tmo to 0 for NO_PATH_RETRY_FAIL (bsc#1229898) * Fixed a memory leak in the nvme foreign library. (bsc#1229898, bsc#1236390) * Fix multipathd crash because of invalid path group index value, for example if an invalid path device was removed from a map. (gh#opensvc/multipath-tools#105, bsc#1236392) * Fix the problem that `group_by_tpg` might be disabled if one or more paths were offline during initial configuration (bsc#1236392) * Make sure udev and systemd notice changes in multipath path state when devices are added to or removed from multipath maps (bsc#1236321) - Version 0.9.8+88+suse.d504d83: * Revert "libmultipath: fix max_sectors_kb on adding path" (bsc#1222458) - Update to version 0.9.8+87+suse.f72b9f3: * fix misspelled DM_UDEV_DISABLE_OTHER_RULES_FLAG in udev rules (bsc#1220810) - Remove libmpathpersist-example-old.c, which has been obsolete since multipath-tools 0.8.6. - Version 0.9.8+83+suse.bcae610 (bsc#1220374): * multipath-tools: added NEWS.md - Version 0.9.8~1+82+suse.dcd98a3: * Adapt package version such that it shows as a 0.9.8 prerelease * Add missing udev rules file - Version 0.9.7+148+suse.9780ae0: * 11-dm-mpath.rules: Fix quoting mistake (bsc#1219142) - Version 0.9.7+148+suse.7d9953e.obscpio * This is a multipath-tools 0.9.8 pre-release * fix fast_io_fail for Infinibox (bsc#1219348) * Fix activation of LVM volume groups during coldplug (bsc#1219142) - Version 0.9.7+140+suse.2d78457: * Socket activation via multipathd.socket has been disabled by default because it has undesirable side effects on systems without multipath. Users with multipath hardware should enable multipathd.service * The restorequeueing CLI command now only enables queueing if disablequeueing had been sent before * Avoid multipathd hang during map flush * multipathd now tracks the queueing mode of maps in its internal features string * Improve error messages in 'multipathd -k' * Fix segfault in autoresize code (bsc#1219289) * Fix missing map reloads (bsc#1219796) * Documentation fixes, spelling fixes, minor code fixes - Version 0.9.7+93+suse.e2f2272: * fix ANA prioritizer enablement logic (bsc#1218326) * avoid setting queue_if_no_path on multipath maps for which the no_path_retry timeout has expired * the interactive commands "restorequeueing map X" and "restorequeing maps" now only affect maps that had queueing manually disabled using "disablequeuing maps" or "disablequeuing map X" beforehand * Spelling fixes - Version 0.9.7+76+suse.5f857af: * Update to upstream 0.9.7 (jsc#PED-6464) * added max_retries config option to limit SCSI retries * added auto_resize config option to enable resizing multipath maps automatically * fixed memory and error handling for code using aio (marginal path code, directio path checker) * dropped modules-load.d/multipath.conf; replaced by a dependency on modprobe@dm-multipath.service (systemd >= 245: SLE15-SP3 and later only) and a softdep on sd_mod for the SCSI device handlers (bsc#1217377) * On SLE/Leap suse-module-tools doesn't ship a scsi_mod->sd_mod softdep yet. Add it here, too. It will be overridden by s-m-t when it's added there. * drop usr_prefix= setting in SLE build recipes (set to /usr by upstream automatically) - Version 0.9.6+115+suse.07776fb * multipathd: Added support to handle FPIN-Li events for FC-NVMe - Update to version 0.9.6+110+suse.5dfdf35: * The options "bindings_file", "prkeys_file", and "wwids_file", which have been deprecated since multipath-tools 0.8.8, aren't supported any more. The paths to these files are now hard-coded to "bindings", "prkeys" and "wwids" under /etc/multipath. * Strictly avoid assigning map aliases that are already taken (bsc#1213265) * Improve handling of user-friendly names * avoid "multipath -d" (dry-run) chang ## Which versions are affected by SUSE-SU-2026:23054-1? | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `multipath-tools` | SUSE:Linux Micro 6.0 | All versions | 0.9.8+292+suse.c0523c1-1.1 | ## How do I fix SUSE-SU-2026:23054-1? Apply the vendor's patch. ## Is SUSE-SU-2026:23054-1 being exploited? There is no known exploitation of SUSE-SU-2026:23054-1 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for SUSE-SU-2026:23054-1 and fix it if it is affected. What it is: SUSE-SU-2026:23054-1 is a vulnerability in multipath-tools, published on 6 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link. Exploitation: There is no known exploitation of SUSE-SU-2026:23054-1 in the wild and no public exploit code. Affected product: multipath-tools. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/SUSE-SU-2026-23054-1/ (Markdown: https://insights.sbomify.com/SUSE-SU-2026-23054-1/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/SUSE-SU-2026:23054-1 --- From sbomify Insights: https://insights.sbomify.com/SUSE-SU-2026-23054-1/ Summaries are generated and may contain mistakes; the official description above is the record.