CVE-2026-114038

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in device-mapper-multipath

Publication date: 2026-10-21

Last updated on: 2026-11-05

Assigner: redhat-SADP

Description

A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-05

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114038

EUVD

EUVD-2026-106990

Affected Vendors & Products

Vendor	Product	Version / Range
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 7	*
Red Hat	Red Hat Enterprise Linux 8	*
Red Hat	Red Hat Enterprise Linux 9	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-114038 is a medium-severity vulnerability in device-mapper-multipath. A local user can send a command with a format string ending in a trailing percent character to the multipath daemon. This causes an out-of-bounds read, exposing daemon memory or crashing the daemon, leading to information disclosure or Denial of Service (DoS).

Detection Guidance

To detect this vulnerability, check if device-mapper-multipath is installed and inspect its version. Look for multipathd daemon logs for crashes or unusual activity. Exploit attempts may involve sending format strings ending with '%' to the multipathd control socket. Use commands like 'rpm -q device-mapper-multipath' to verify versions and 'journalctl -u multipathd' to review logs for daemon crashes or memory access errors.

Impact Analysis

Information disclosure: Unintended daemon memory may be exposed to local attackers.
Denial of Service (DoS): The daemon may crash due to the out-of-bounds read.
Limited impact: No privilege escalation or arbitrary code execution is possible.

Compliance Impact

This vulnerability may impact compliance by exposing sensitive data through information disclosure, which could violate confidentiality requirements in GDPR or HIPAA. Organizations must mitigate the risk to protect personal or health information.

Mitigation Strategies

Immediately restrict access to the multipathd control socket by removing permissions for unprivileged users. Disable unprivileged access to format string operations in multipathd. Monitor the multipathd daemon for crashes or instability. Apply patches once available from Red Hat. Temporarily disable multipathd if unprivileged access cannot be restricted.

Hi! I’m here to help you understand CVE-2026-114038. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...