CVE-2026-114038

A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).

Red Hat Product Security has rated this vulnerability as having Moderate impact because an unprivileged local attacker can exploit it via the multipathd control socket to trigger a denial of service or leak limited process memory, without achieving code execution or elevated privileges. While the multipath daemon restricts administrative configuration commands to root, query commands such as path and map listings are accessible to unprivileged local users by default, exposing the custom format parser. Because the defect only causes an out-of-bounds heap read within the daemon's own address space and does not allow modifying system state, the blast radius remains constrained to local daemon availability and nondeterministic memory disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.