SUSE-SU-2026:23054-1: critical: Security update for multipath-tools

SLE-SECURITY-UPDATES null at suse.de
Wed Aug 12 08:37:48 UTC 2026 

# Security update for multipath-tools

Announcement ID: SUSE-SU-2026:23054-1  
Release Date: 2026-08-06T08:40:27Z  
Rating: critical  
References:

  * bsc#1212854
  * bsc#1213265
  * bsc#1213809
  * bsc#1217377
  * bsc#1218326
  * bsc#1219142
  * bsc#1219289
  * bsc#1219348
  * bsc#1219796
  * bsc#1220374
  * bsc#1220810
  * bsc#1222458
  * bsc#1228926
  * bsc#1229898
  * bsc#1232063
  * bsc#1232227
  * bsc#1236321
  * bsc#1236390
  * bsc#1236392
  * bsc#1253260
  * bsc#1254094
  * bsc#1255285
  * bsc#1257007
  * bsc#1257153
  * bsc#1257244
  * bsc#1268144
  * bsc#1268145
  * jsc#PED-6464

  
Affected Products:

  * SUSE Linux Micro 6.0

  
  
An update that contains one feature and has 27 fixes can now be installed.

## Description:

This update for multipath-tools fixes the following issues:

Update to version 0.9.8+292+suse.c0523c1.

Security issues fixed:

  * kpartx: integer overflow in the GPT partition table size calculation can
    lead to heap OOB read via crafted USB device or disk image(bsc#1268145).
  * kpartx: missing bounds check can lead to a DASD VOL1 unbounded array write
    via a crafted DASD disk with more than 256 consecutive format labels
    (bsc#1268144).

Other updates and bugfixes:

  * [Build 32.2] System with multipath fails to boot during first boot during
    the installation (bsc#1232063).
  * [Build 50.1] multipath btrfs i/o error on both Leap 15.6 and SLES 15 SP6
    (bsc#1219289).
  * Fix code that leads to `is_bit_set_in_bitfield: bitfield overflow: 1 >=
    0` message showing up in syslog (bsc#1255285).
  * Version 0.9.8+266+suse.53479977 (bsc#1257007):
  * kpartx: fix segfault when operating on regular files (bsc#1257244,
    bsc#1257153)
  * multipathd: print path offline message even without a checker (bsc#1254094)
  * Fix command descriptions in the multipathd man page.
  * Fix ISO C23 compatibility issue causing errors with new compilers.
  * Fix memory leak caused by not joining the "init unwinder" thread.
  * Fix memory leaks in kpartx.
  * Print the warning "setting scsi timeouts is unsupported for protocol" only
    once per protocol.
  * Make sure multipath-tools is compiled with the compiler flag `-fno-strict-
    aliasing`. (gh#opensvc/multipath-tools#130, bsc#1255285)
  * Version 0.9.8+247+suse.863ae86f:
  * Log offline path state if "log_checker_err always" is set
  * Version 0.9.8+246+suse.fb81edd2:
  * CI: GitHub workflow updates. No code changes.
  * Version 0.9.8+166+suse.95399ce1:
  * Backported fixes from upstream 0.9.9 ... 0.10.5 (bsc#1253260)
    * Updates to the built-in hardware table:
    * add some NVMe storage array (VASTData, Infinidat, HITACHI VSP)
    * add QSAN
    * add EqualLogic PS
    * Add Quantum devices
    * Enable ALUA for AStor/NeoSapphire
    * Update NFINIDAT/InfiniBox config
    * Fix product blacklist of S/390 devices
    * Add Seagate Lyve
    * Add HITACHI VSP One SDS Block
    * Add SCST (SCSI Target Subsystem for Linux)
    * Huawei storage arrays
    * XSG1 vendors
    * Avoid a possible system hang during shutdown with queueing multipath maps.
    * Failed paths should be checked every `polling_interval`. In certain cases, this wouldn't happen, because the check interval wasn't reset by multipathd.
    * It could happen that multipathd would accidentally release a SCSI persistent reservation held by another node. Fix it.
    * After manually failing some paths and then reinstating them, sometimes the reinstated paths were immediately failed again by multipathd.
    * Fixed the problem that, if there were multiple maps with deferred failback (`failback` value > 0 in `multipath.conf`), some maps might fail back later than configured.
    * Fixed a problem in the marginal path detection algorithm that could cause the io error check for a recently failed path to be delayed.
    * Fixed a minor bug in the config file parser
    * Fixed minor issues detected by coverity.
  * Version 0.9.8+111+suse.b7ee850:
  * Backported bug fixes from upstream 0.9.9 - 0.10.2
    * Fixed old mpathpersist bug leading to the error message "configured reservation key doesn't match: 0x0" when `reservation_key` was configured in the multipaths section of `multipath.conf`. (bsc#1228926, gh#opensvc/multipath-tools#92)
    * Fixed bug that caused queueing to be always disabled if flushing a map failed (bug introduced in 0.9.8). (bsc#1229898)
    * Fixed output of `multipath -t` and `multipath -T` for the options `force_sync` and `retrigger_tries`. (bsc#1229898, gh#opensvc/multipath-tools#88)
    * libmultipath: don't print error message if WATCHDOG_USEC is 0 (bsc#1232227)
    * Fix map failure count for no_path_retry > 0 (bsc#1229898)
    * Fix reboot hang if uevent is processed for suspended device (bsc#1232063)
    * libmultipath: don't set dev_loss_tmo to 0 for NO_PATH_RETRY_FAIL (bsc#1229898)
    * Fixed a memory leak in the nvme foreign library. (bsc#1229898, bsc#1236390)
    * Fix multipathd crash because of invalid path group index value, for example if an invalid path device was removed from a map. (gh#opensvc/multipath-tools#105, bsc#1236392)
    * Fix the problem that `group_by_tpg` might be disabled if one or more paths were offline during initial configuration (bsc#1236392)
    * Make sure udev and systemd notice changes in multipath path state when devices are added to or removed from multipath maps (bsc#1236321)
  * Version 0.9.8+88+suse.d504d83:
  * Revert "libmultipath: fix max_sectors_kb on adding path" (bsc#1222458)
  * Update to version 0.9.8+87+suse.f72b9f3:
  * fix misspelled DM_UDEV_DISABLE_OTHER_RULES_FLAG in udev rules (bsc#1220810)
  * Remove libmpathpersist-example-old.c, which has been obsolete since
    multipath-tools 0.8.6.
  * Version 0.9.8+83+suse.bcae610 (bsc#1220374):
  * multipath-tools: added NEWS.md
  * Version 0.9.8~1+82+suse.dcd98a3:
  * Adapt package version such that it shows as a 0.9.8 prerelease
  * Add missing udev rules file
  * Version 0.9.7+148+suse.9780ae0:
  * 11-dm-mpath.rules: Fix quoting mistake (bsc#1219142)
  * Version 0.9.7+148+suse.7d9953e.obscpio
  * This is a multipath-tools 0.9.8 pre-release
  * fix fast_io_fail for Infinibox (bsc#1219348)
  * Fix activation of LVM volume groups during coldplug (bsc#1219142)
  * Version 0.9.7+140+suse.2d78457:
  * Socket activation via multipathd.socket has been disabled by default because
    it has undesirable side effects on systems without multipath. Users with
    multipath hardware should enable multipathd.service
  * The restorequeueing CLI command now only enables queueing if disablequeueing
    had been sent before
  * Avoid multipathd hang during map flush
  * multipathd now tracks the queueing mode of maps in its internal features
    string
  * Improve error messages in 'multipathd -k'
  * Fix segfault in autoresize code (bsc#1219289)
  * Fix missing map reloads (bsc#1219796)
  * Documentation fixes, spelling fixes, minor code fixes
  * Version 0.9.7+93+suse.e2f2272:
  * fix ANA prioritizer enablement logic (bsc#1218326)
  * avoid setting queue_if_no_path on multipath maps for which the no_path_retry
    timeout has expired
  * the interactive commands "restorequeueing map X" and "restorequeing maps"
    now only affect maps that had queueing manually disabled using
    "disablequeuing maps" or "disablequeuing map X" beforehand
  * Spelling fixes
  * Version 0.9.7+76+suse.5f857af:
  * Update to upstream 0.9.7 (jsc#PED-6464)
  * added max_retries config option to limit SCSI retries
  * added auto_resize config option to enable resizing multipath maps
    automatically
  * fixed memory and error handling for code using aio (marginal path code,
    directio path checker)
  * dropped modules-load.d/multipath.conf; replaced by a dependency on
    modprobe at dm-multipath.service (systemd >= 245: SLE15-SP3 and later only) and
    a softdep on sd_mod for the SCSI device handlers (bsc#1217377)
  * On SLE/Leap suse-module-tools doesn't ship a scsi_mod->sd_mod softdep yet.
    Add it here, too. It will be overridden by s-m-t when it's added there.
  * drop usr_prefix= setting in SLE build recipes (set to /usr by upstream
    automatically)
  * Version 0.9.6+115+suse.07776fb
  * multipathd: Added support to handle FPIN-Li events for FC-NVMe
  * Update to version 0.9.6+110+suse.5dfdf35:
  * The options "bindings_file", "prkeys_file", and "wwids_file", which have
    been deprecated since multipath-tools 0.8.8, aren't supported any more. The
    paths to these files are now hard-coded to "bindings", "prkeys" and "wwids"
    under /etc/multipath.
  * Strictly avoid assigning map aliases that are already taken (bsc#1213265)
  * Improve handling of user-friendly names
  * avoid "multipath -d" (dry-run) changing SCSI timeouts in sysfs (bsc#1213809)
  * `spec` file:
  * adapt prefix values to upstream changes
  * fix compilation flags for `make check`
  * pass EXTRAVERSION to build (bsc#1212854)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Micro 6.0  
    zypper in -t patch SUSE-SLE-Micro-6.0-832=1

## Package List:

  * SUSE Linux Micro 6.0 (aarch64 s390x x86_64)
    * multipath-tools-debugsource-0.9.8+292+suse.c0523c1-1.1
    * libmpath0-debuginfo-0.9.8+292+suse.c0523c1-1.1
    * libmpath0-0.9.8+292+suse.c0523c1-1.1
    * multipath-tools-debuginfo-0.9.8+292+suse.c0523c1-1.1
    * multipath-tools-0.9.8+292+suse.c0523c1-1.1
    * kpartx-0.9.8+292+suse.c0523c1-1.1
    * kpartx-debuginfo-0.9.8+292+suse.c0523c1-1.1

## References:

  * https://bugzilla.suse.com/show_bug.cgi?id=1212854
  * https://bugzilla.suse.com/show_bug.cgi?id=1213265
  * https://bugzilla.suse.com/show_bug.cgi?id=1213809
  * https://bugzilla.suse.com/show_bug.cgi?id=1217377
  * https://bugzilla.suse.com/show_bug.cgi?id=1218326
  * https://bugzilla.suse.com/show_bug.cgi?id=1219142
  * https://bugzilla.suse.com/show_bug.cgi?id=1219289
  * https://bugzilla.suse.com/show_bug.cgi?id=1219348
  * https://bugzilla.suse.com/show_bug.cgi?id=1219796
  * https://bugzilla.suse.com/show_bug.cgi?id=1220374
  * https://bugzilla.suse.com/show_bug.cgi?id=1220810
  * https://bugzilla.suse.com/show_bug.cgi?id=1222458
  * https://bugzilla.suse.com/show_bug.cgi?id=1228926
  * https://bugzilla.suse.com/show_bug.cgi?id=1229898
  * https://bugzilla.suse.com/show_bug.cgi?id=1232063
  * https://bugzilla.suse.com/show_bug.cgi?id=1232227
  * https://bugzilla.suse.com/show_bug.cgi?id=1236321
  * https://bugzilla.suse.com/show_bug.cgi?id=1236390
  * https://bugzilla.suse.com/show_bug.cgi?id=1236392
  * https://bugzilla.suse.com/show_bug.cgi?id=1253260
  * https://bugzilla.suse.com/show_bug.cgi?id=1254094
  * https://bugzilla.suse.com/show_bug.cgi?id=1255285
  * https://bugzilla.suse.com/show_bug.cgi?id=1257007
  * https://bugzilla.suse.com/show_bug.cgi?id=1257153
  * https://bugzilla.suse.com/show_bug.cgi?id=1257244
  * https://bugzilla.suse.com/show_bug.cgi?id=1268144
  * https://bugzilla.suse.com/show_bug.cgi?id=1268145
  * https://jira.suse.com/browse/PED-6464

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20260812/8c5ca547/attachment.htm>

More information about the sle-security-updates mailing list