<div class="container">
<h1>Security update for multipath-tools</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:23054-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-08-06T08:40:27Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>critical</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1212854">bsc#1212854</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1213265">bsc#1213265</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1213809">bsc#1213809</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1217377">bsc#1217377</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1218326">bsc#1218326</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1219142">bsc#1219142</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1219289">bsc#1219289</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1219348">bsc#1219348</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1219796">bsc#1219796</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1220374">bsc#1220374</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1220810">bsc#1220810</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1222458">bsc#1222458</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1228926">bsc#1228926</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1229898">bsc#1229898</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1232063">bsc#1232063</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1232227">bsc#1232227</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236321">bsc#1236321</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236390">bsc#1236390</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236392">bsc#1236392</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1253260">bsc#1253260</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1254094">bsc#1254094</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1255285">bsc#1255285</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257007">bsc#1257007</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257153">bsc#1257153</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257244">bsc#1257244</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268144">bsc#1268144</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268145">bsc#1268145</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/PED-6464">jsc#PED-6464</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Micro 6.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that contains one feature and has 27 fixes can now be installed.</p>
<h2>Description:</h2>
<p>This update for multipath-tools fixes the following issues:</p>
<p>Update to version 0.9.8+292+suse.c0523c1.</p>
<p>Security issues fixed:</p>
<ul>
<li>kpartx: integer overflow in the GPT partition table size calculation can lead to heap OOB read via crafted USB device
or disk image(bsc#1268145).</li>
<li>kpartx: missing bounds check can lead to a DASD VOL1 unbounded array write via a crafted DASD disk with more than 256
consecutive format labels (bsc#1268144).</li>
</ul>
<p>Other updates and bugfixes:</p>
<ul>
<li>[Build 32.2] System with multipath fails to boot during first boot during the installation (bsc#1232063).</li>
<li>[Build 50.1] multipath btrfs i/o error on both Leap 15.6 and SLES 15 SP6 (bsc#1219289).</li>
<li>Fix code that leads to <code>is_bit_set_in_bitfield: bitfield overflow: 1 >= 0</code> message showing up in syslog
(bsc#1255285).</li>
<li>Version 0.9.8+266+suse.53479977 (bsc#1257007):</li>
<li>kpartx: fix segfault when operating on regular files (bsc#1257244, bsc#1257153)</li>
<li>multipathd: print path offline message even without a checker (bsc#1254094)</li>
<li>Fix command descriptions in the multipathd man page.</li>
<li>Fix ISO C23 compatibility issue causing errors with new compilers.</li>
<li>Fix memory leak caused by not joining the "init unwinder" thread.</li>
<li>Fix memory leaks in kpartx.</li>
<li>Print the warning "setting scsi timeouts is unsupported for protocol" only once per protocol.</li>
<li>Make sure multipath-tools is compiled with the compiler flag <code>-fno-strict-aliasing</code>.
(gh#opensvc/multipath-tools#130, bsc#1255285)</li>
<li>Version 0.9.8+247+suse.863ae86f:</li>
<li>Log offline path state if "log_checker_err always" is set</li>
<li>Version 0.9.8+246+suse.fb81edd2:</li>
<li>CI: GitHub workflow updates. No code changes.</li>
<li>Version 0.9.8+166+suse.95399ce1:</li>
<li>Backported fixes from upstream 0.9.9 ... 0.10.5 (bsc#1253260)<ul>
<li>Updates to the built-in hardware table:</li>
<li>add some NVMe storage array (VASTData, Infinidat, HITACHI VSP)</li>
<li>add QSAN</li>
<li>add EqualLogic PS</li>
<li>Add Quantum devices</li>
<li>Enable ALUA for AStor/NeoSapphire</li>
<li>Update NFINIDAT/InfiniBox config</li>
<li>Fix product blacklist of S/390 devices</li>
<li>Add Seagate Lyve</li>
<li>Add HITACHI VSP One SDS Block</li>
<li>Add SCST (SCSI Target Subsystem for Linux)</li>
<li>Huawei storage arrays</li>
<li>XSG1 vendors</li>
<li>Avoid a possible system hang during shutdown with queueing multipath maps.</li>
<li>Failed paths should be checked every <code>polling_interval</code>. In certain cases,
this wouldn't happen, because the check interval wasn't reset by multipathd.</li>
<li>It could happen that multipathd would accidentally release a SCSI persistent
reservation held by another node. Fix it.</li>
<li>After manually failing some paths and then reinstating them, sometimes
the reinstated paths were immediately failed again by multipathd.</li>
<li>Fixed the problem that, if there were multiple maps with deferred failback
(<code>failback</code> value > 0 in <code>multipath.conf</code>), some maps might fail back later
than configured.</li>
<li>Fixed a problem in the marginal path detection algorithm that could cause
the io error check for a recently failed path to be delayed.</li>
<li>Fixed a minor bug in the config file parser</li>
<li>Fixed minor issues detected by coverity.</li>
</ul>
</li>
<li>Version 0.9.8+111+suse.b7ee850:</li>
<li>Backported bug fixes from upstream 0.9.9 - 0.10.2<ul>
<li>Fixed old mpathpersist bug leading to the error message "configured reservation
key doesn't match: 0x0" when <code>reservation_key</code> was configured in the
multipaths section of <code>multipath.conf</code>. (bsc#1228926, gh#opensvc/multipath-tools#92)</li>
<li>Fixed bug that caused queueing to be always disabled if flushing a map failed
(bug introduced in 0.9.8). (bsc#1229898)</li>
<li>Fixed output of <code>multipath -t</code> and <code>multipath -T</code> for the options
<code>force_sync</code> and <code>retrigger_tries</code>. (bsc#1229898, gh#opensvc/multipath-tools#88)</li>
<li>libmultipath: don't print error message if WATCHDOG_USEC is 0 (bsc#1232227)</li>
<li>Fix map failure count for no_path_retry > 0 (bsc#1229898)</li>
<li>Fix reboot hang if uevent is processed for suspended device (bsc#1232063)</li>
<li>libmultipath: don't set dev_loss_tmo to 0 for NO_PATH_RETRY_FAIL (bsc#1229898)</li>
<li>Fixed a memory leak in the nvme foreign library. (bsc#1229898, bsc#1236390)</li>
<li>Fix multipathd crash because of invalid path group index value, for example if an invalid
path device was removed from a map. (gh#opensvc/multipath-tools#105, bsc#1236392)</li>
<li>Fix the problem that <code>group_by_tpg</code> might be disabled if one or more
paths were offline during initial configuration (bsc#1236392)</li>
<li>Make sure udev and systemd notice changes in multipath path state
when devices are added to or removed from multipath maps (bsc#1236321)</li>
</ul>
</li>
<li>Version 0.9.8+88+suse.d504d83:</li>
<li>Revert "libmultipath: fix max_sectors_kb on adding path" (bsc#1222458)</li>
<li>Update to version 0.9.8+87+suse.f72b9f3:</li>
<li>fix misspelled DM_UDEV_DISABLE_OTHER_RULES_FLAG in udev rules (bsc#1220810)</li>
<li>Remove libmpathpersist-example-old.c, which has been obsolete since multipath-tools 0.8.6.</li>
<li>Version 0.9.8+83+suse.bcae610 (bsc#1220374):</li>
<li>multipath-tools: added NEWS.md</li>
<li>Version 0.9.8~1+82+suse.dcd98a3:</li>
<li>Adapt package version such that it shows as a 0.9.8 prerelease</li>
<li>Add missing udev rules file</li>
<li>Version 0.9.7+148+suse.9780ae0:</li>
<li>11-dm-mpath.rules: Fix quoting mistake (bsc#1219142)</li>
<li>Version 0.9.7+148+suse.7d9953e.obscpio</li>
<li>This is a multipath-tools 0.9.8 pre-release</li>
<li>fix fast_io_fail for Infinibox (bsc#1219348)</li>
<li>Fix activation of LVM volume groups during coldplug (bsc#1219142)</li>
<li>Version 0.9.7+140+suse.2d78457:</li>
<li>Socket activation via multipathd.socket has been disabled by default
because it has undesirable side effects on systems without multipath.
Users with multipath hardware should enable multipathd.service</li>
<li>The restorequeueing CLI command now only enables queueing if
disablequeueing had been sent before</li>
<li>Avoid multipathd hang during map flush</li>
<li>multipathd now tracks the queueing mode of maps in its internal features string</li>
<li>Improve error messages in 'multipathd -k'</li>
<li>Fix segfault in autoresize code (bsc#1219289)</li>
<li>Fix missing map reloads (bsc#1219796)</li>
<li>Documentation fixes, spelling fixes, minor code fixes</li>
<li>Version 0.9.7+93+suse.e2f2272:</li>
<li>fix ANA prioritizer enablement logic (bsc#1218326)</li>
<li>avoid setting queue_if_no_path on multipath maps for which the
no_path_retry timeout has expired</li>
<li>the interactive commands "restorequeueing map X" and
"restorequeing maps" now only affect maps that had queueing
manually disabled using "disablequeuing maps" or
"disablequeuing map X" beforehand</li>
<li>Spelling fixes</li>
<li>Version 0.9.7+76+suse.5f857af:</li>
<li>Update to upstream 0.9.7 (jsc#PED-6464)</li>
<li>added max_retries config option to limit SCSI retries</li>
<li>added auto_resize config option to enable resizing multipath maps automatically</li>
<li>fixed memory and error handling for code using aio (marginal path code,
directio path checker)</li>
<li>dropped modules-load.d/multipath.conf; replaced by a dependency on
modprobe@dm-multipath.service (systemd >= 245: SLE15-SP3 and later only)
and a softdep on sd_mod for the SCSI device handlers (bsc#1217377)</li>
<li>On SLE/Leap suse-module-tools doesn't ship a scsi_mod->sd_mod softdep yet.
Add it here, too. It will be overridden by s-m-t when it's added there.</li>
<li>drop usr_prefix= setting in SLE build recipes (set to /usr by upstream
automatically)</li>
<li>Version 0.9.6+115+suse.07776fb</li>
<li>multipathd: Added support to handle FPIN-Li events for FC-NVMe</li>
<li>Update to version 0.9.6+110+suse.5dfdf35:</li>
<li>The options "bindings_file", "prkeys_file", and "wwids_file",
which have been deprecated since multipath-tools 0.8.8,
aren't supported any more. The paths to these files are now
hard-coded to "bindings", "prkeys" and "wwids" under
/etc/multipath.</li>
<li>Strictly avoid assigning map aliases that are already taken
(bsc#1213265)</li>
<li>Improve handling of user-friendly names</li>
<li>avoid "multipath -d" (dry-run) changing SCSI timeouts in sysfs (bsc#1213809)</li>
<li><code>spec</code> file:</li>
<li>adapt prefix values to upstream changes</li>
<li>fix compilation flags for <code>make check</code></li>
<li>pass EXTRAVERSION to build (bsc#1212854)</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Micro 6.0
<br/>
<code>zypper in -t patch SUSE-SLE-Micro-6.0-832=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Micro 6.0 (aarch64 s390x x86_64)
<ul>
<li>multipath-tools-debugsource-0.9.8+292+suse.c0523c1-1.1</li>
<li>libmpath0-debuginfo-0.9.8+292+suse.c0523c1-1.1</li>
<li>libmpath0-0.9.8+292+suse.c0523c1-1.1</li>
<li>multipath-tools-debuginfo-0.9.8+292+suse.c0523c1-1.1</li>
<li>multipath-tools-0.9.8+292+suse.c0523c1-1.1</li>
<li>kpartx-0.9.8+292+suse.c0523c1-1.1</li>
<li>kpartx-debuginfo-0.9.8+292+suse.c0523c1-1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1212854">https://bugzilla.suse.com/show_bug.cgi?id=1212854</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1213265">https://bugzilla.suse.com/show_bug.cgi?id=1213265</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1213809">https://bugzilla.suse.com/show_bug.cgi?id=1213809</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1217377">https://bugzilla.suse.com/show_bug.cgi?id=1217377</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1218326">https://bugzilla.suse.com/show_bug.cgi?id=1218326</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1219142">https://bugzilla.suse.com/show_bug.cgi?id=1219142</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1219289">https://bugzilla.suse.com/show_bug.cgi?id=1219289</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1219348">https://bugzilla.suse.com/show_bug.cgi?id=1219348</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1219796">https://bugzilla.suse.com/show_bug.cgi?id=1219796</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1220374">https://bugzilla.suse.com/show_bug.cgi?id=1220374</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1220810">https://bugzilla.suse.com/show_bug.cgi?id=1220810</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1222458">https://bugzilla.suse.com/show_bug.cgi?id=1222458</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1228926">https://bugzilla.suse.com/show_bug.cgi?id=1228926</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1229898">https://bugzilla.suse.com/show_bug.cgi?id=1229898</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1232063">https://bugzilla.suse.com/show_bug.cgi?id=1232063</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1232227">https://bugzilla.suse.com/show_bug.cgi?id=1232227</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236321">https://bugzilla.suse.com/show_bug.cgi?id=1236321</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236390">https://bugzilla.suse.com/show_bug.cgi?id=1236390</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236392">https://bugzilla.suse.com/show_bug.cgi?id=1236392</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1253260">https://bugzilla.suse.com/show_bug.cgi?id=1253260</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1254094">https://bugzilla.suse.com/show_bug.cgi?id=1254094</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1255285">https://bugzilla.suse.com/show_bug.cgi?id=1255285</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257007">https://bugzilla.suse.com/show_bug.cgi?id=1257007</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257153">https://bugzilla.suse.com/show_bug.cgi?id=1257153</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257244">https://bugzilla.suse.com/show_bug.cgi?id=1257244</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268144">https://bugzilla.suse.com/show_bug.cgi?id=1268144</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268145">https://bugzilla.suse.com/show_bug.cgi?id=1268145</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-6464">https://jira.suse.com/browse/PED-6464</a>
</li>
</ul>
</div>