CVE-2026-89329CWE-1322

CVE-2026-89329

Medium · published September 11, 2026

CVSS v3.1
6.2
EPSS
0%
Percentile
5.4
In the wild
Unconfirmed
What it is

A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the `multipathd` listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00164 · 5.4th percentile
Weakness
CWE-1322 · Use of Blocking Code in Single-threaded, Non-blocking Context
Published
2026-09-11T23:17Z
References (2)
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 18:42Z
    Device-mapper-multipath: local denial of service via blocking ipc send operations
    cvelistv5