{"answers":{"affected":"","exploited":"There is no known exploitation of SUSE-SU-2026:23160-1 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"SUSE-SU-2026:23160-1 is a vulnerability in multipath-tools, published on 4 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for SUSE-SU-2026:23160-1 and fix it if it is affected.\n\nWhat it is: SUSE-SU-2026:23160-1 is a vulnerability in multipath-tools, published on 4 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of SUSE-SU-2026:23160-1 in the wild and no public exploit code.\n\nAffected product: multipath-tools. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/SUSE-SU-2026-23160-1/ (Markdown: https://insights.sbomify.com/SUSE-SU-2026-23160-1/index.md)","id":"SUSE-SU-2026:23160-1","markdown":"https://insights.sbomify.com/SUSE-SU-2026-23160-1/index.md","name":"SUSE-SU-2026:23160-1","record":{"aliases":[],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"SUSE multipath-tools","requires_auth":"none","summary":"Integer overflow and missing bounds checks in kpartx allow heap out-of-bounds reads and unbounded writes via crafted USB or DASD devices, potentially leading to code execution or crashes.","user_interaction":"required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"This update for multipath-tools fixes the following issues:\n\nUpdate to version 0.10.7~1+211+suse.18f1559.\n\nSecurity issues fixed:\n\n- kpartx: integer overflow in the GPT partition table size calculation can lead to heap OOB read via crafted USB device\n  or disk image(bsc#1268145).\n- kpartx: missing bounds check can lead to a DASD VOL1 unbounded array write via a crafted DASD disk with more than 256\n  consecutive format labels (bsc#1268144).\n\nOther updates and bugfixes:\n\n- Fix system with multipath failing to boot during first boot during the installation (bsc#1232063).\n- Fix code that leads to `is_bit_set_in_bitfield: bitfield overflow: 1 \u003e= 0` message showing up in syslog\n  (bsc#1255285).\n- Version 0.10.7~1+211+suse.18f1559:\n  * Fix ALUA asymmetric access state descriptions in multipathd logs, so that\n    the same terms are used as by the kernel (\"lba-dependent\", \"transitioning\").\n  * Don't set a hardware handler for bio-based multipath devices. The kernel\n    rejects this anyway.\n  * Fix WWID detection for legacy devices that use the older SCSI-2 VPD page\n    0x83 format for their device identifier.\n  * Fix duplicate \"checker timed out\" log messages when `log_checker_err` is\n    set to `once`. (bsc#1254094)\n  * Avoid potential buffer overflows in the iet and datacore prioritizers.\n  * iet prioritizer: avoid misleading error message with systemd 256 and\n    newer, and properly use udev to derive path parameters.\n    (gh#opensvc/multipath-tools#145)\n- Version 0.10.6+201+suse.9f189e79:\n  * libmultipath: reduce log level of \"map X has no targets\" (bsc#1257476)\n- Version 0.10.6+200+suse.547788f4 (bsc#1257007):\n  * kpartx: fix segfault when operating on regular files (bsc#1257244, bsc#1257153)\n  * multipathd: print path offline message even without a checker\n    (bsc#1254094)\n  * Fix command descriptions in the multipathd man page.\n  * Fix ISO C23 compatibility issue causing errors with new compilers.\n  * Fix memory leak caused by not joining the \"init unwinder\" thread.\n  * Fix memory leaks in kpartx.\n  * Print the warning \"setting scsi timeouts is unsupported for protocol\" only\n    once per protocol.\n  * Make sure multipath-tools is compiled with the compiler flag\n    `-fno-strict-aliasing`. (gh#opensvc/multipath-tools#130, bsc#1255285)\n- Version 0.10.5+213+suse.04c3a0ac:\n  * Log offline path state if \"log_checker_err always\" is set\n  * mpathpersist: Fix REPORT CAPABILITIES output\n- Version 0.10.5+190+suse.a9f87040:\n  * CI: GitHub workflow updates. No code changes.\n- _service: switched to tar_scm for git LFS.\n- Version 0.10.5+125+suse.1ed79487:\n  - Fixes from upstream 0.10.5 (see also NEWS.md) (bsc#1253260)\n    * Improved the communication with **udev** and **systemd** by triggering\n      uevents when path devices are added to or removed from multipath maps,\n      or when `multipathd reconfigure` is executed after changing blacklist\n      directives in `multipath.conf`.\n    * Failed paths should be checked every `polling_interval`. In certain cases,\n      this wouldn't happen, because the check interval wasn't reset by multipathd.\n    * It could happen that multipathd would accidentally release a SCSI persistent\n      reservation held by another node. Fix it.\n    * After manually failing some paths and then reinstating them, sometimes\n      the reinstated paths were immediately failed again by multipathd. Fix it.\n    * Various minor fixes reported by coverity.\n- Version 0.10.3+124+suse.ed5b4b11:\n  * multipath-tools: add HPE MSA Gen7 (2070/2072) to hwtable (bsc#1246501)\n- Version 0.10.2+123+suse.48d66ee8:\n  * multipathd: cli_reinstate(): avoid reinstated paths being failed again\n    (bsc#1244917)\n- Version 0.10.2+122+suse.51e02cc:\n  * multipathd: fix hang during shutdown with queuing maps\n    (bsc#1238484).\n  * This adds multipathd-queueing.service.\n- Version 0.10.2+117+suse.33411aa:\n  * multipathd: trigger uevents for blacklisted paths in reconfigure\n    (bsc#1236321)\n  * Make sure maps are reloaded in the path checker loop after detecting an\n    inconsistent or wrong kernel state (bsc#1236392)\n  * Make sure udev and systemd notice changes in multipath path state\n    when devices are added to or removed from multipath maps (bsc#1236321)\n  * Fix the problem that `group_by_tpg` might be disabled if one or more\n    paths were offline during initial configuration (bsc#1236392)\n  * Fix multipathd crash because of invalid path group index value, for example\n    if an invalid path device was removed from a map.\n    (gh#opensvc/multipath-tools#105, bsc#1236392)\n  * Fixed a memory leak in the nvme foreign library.\n  * Fixed a problem in the marginal path detection algorithm that could cause\n    the io error check for a recently failed path to be delayed.\n    (bsc#1236390)\n  * Reduce log level of harmless \"map ... doesn't exist\" message\n- Version 0.10.1~2+112+suse.b66763a:\n  * libmultipath: reduce log level of \"map X has multiple targets\"\n    (bsc#1233588)\n- Version 0.10.1~1+113+suse.d6eca5e:\n  * This is a pre-release of the upstream stable release 0.10.1.\n  * libmultipath: dm_get_maps(): don't bail out for single-map failures\n    (bsc#1233588, gh#opensvc/multipath-tools#102)\n  * libmultipath: don't print error message if WATCHDOG_USEC is 0\n    (bsc#1232227)\n  * libmultipath: don't set dev_loss_tmo to 0 for NO_PATH_RETRY_FAIL\n  * multipathd: fix deferred_failback_tick for reload removes\n- Version 0.10.0+108+suse.2c2e597:\n  * Update fix for bsc#1232063 to upstream-accepted solution\n- Version 0.10.0+106+suse.ffbdb7a:\n  * Fix reboot hang if uevent is processed for suspended device\n    (bsc#1232063)","ecosystems":["SUSE:Linux Micro 6.1"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Security update for multipath-tools","id":"SUSE-SU-2026:23160-1","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"SUSE:Linux Micro 6.1","fixed":["0.10.7~1+211+suse.18f1559-slfo.1.1_1.1"],"introduced":["0"],"last_affected":[],"package":"multipath-tools","purl":"pkg:rpm/suse/multipath-tools\u0026distro=SUSE%20Linux%20Micro%206.1","source":"SUSE-SU-2026:23160-1"}],"products":null,"published":"2026-08-04","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"SUSE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Integer overflow and missing bounds checks in kpartx allow heap out-of-bounds reads and unbounded writes via crafted USB or DASD devices, potentially leading to code execution or crashes.","url":"https://insights.sbomify.com/SUSE-SU-2026-23160-1/"}