<div class="container">
<h1>Security update for multipath-tools</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:23160-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-08-04T11:04:57Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>critical</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1232063">bsc#1232063</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1232227">bsc#1232227</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1233588">bsc#1233588</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236321">bsc#1236321</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236390">bsc#1236390</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236392">bsc#1236392</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1238484">bsc#1238484</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1244917">bsc#1244917</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1246501">bsc#1246501</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1253260">bsc#1253260</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1254094">bsc#1254094</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1255285">bsc#1255285</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257007">bsc#1257007</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257153">bsc#1257153</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257244">bsc#1257244</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257476">bsc#1257476</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268144">bsc#1268144</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268145">bsc#1268145</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Micro 6.1</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that has 18 fixes can now be installed.</p>
<h2>Description:</h2>
<p>This update for multipath-tools fixes the following issues:</p>
<p>Update to version 0.10.7~1+211+suse.18f1559.</p>
<p>Security issues fixed:</p>
<ul>
<li>kpartx: integer overflow in the GPT partition table size calculation can lead to heap OOB read via crafted USB device
or disk image(bsc#1268145).</li>
<li>kpartx: missing bounds check can lead to a DASD VOL1 unbounded array write via a crafted DASD disk with more than 256
consecutive format labels (bsc#1268144).</li>
</ul>
<p>Other updates and bugfixes:</p>
<ul>
<li>Fix system with multipath failing to boot during first boot during the installation (bsc#1232063).</li>
<li>Fix code that leads to <code>is_bit_set_in_bitfield: bitfield overflow: 1 >= 0</code> message showing up in syslog
(bsc#1255285).</li>
<li>Version 0.10.7~1+211+suse.18f1559:</li>
<li>Fix ALUA asymmetric access state descriptions in multipathd logs, so that
the same terms are used as by the kernel ("lba-dependent", "transitioning").</li>
<li>Don't set a hardware handler for bio-based multipath devices. The kernel
rejects this anyway.</li>
<li>Fix WWID detection for legacy devices that use the older SCSI-2 VPD page
0x83 format for their device identifier.</li>
<li>Fix duplicate "checker timed out" log messages when <code>log_checker_err</code> is
set to <code>once</code>. (bsc#1254094)</li>
<li>Avoid potential buffer overflows in the iet and datacore prioritizers.</li>
<li>iet prioritizer: avoid misleading error message with systemd 256 and
newer, and properly use udev to derive path parameters.
(gh#opensvc/multipath-tools#145)</li>
<li>Version 0.10.6+201+suse.9f189e79:</li>
<li>libmultipath: reduce log level of "map X has no targets" (bsc#1257476)</li>
<li>Version 0.10.6+200+suse.547788f4 (bsc#1257007):</li>
<li>kpartx: fix segfault when operating on regular files (bsc#1257244, bsc#1257153)</li>
<li>multipathd: print path offline message even without a checker
(bsc#1254094)</li>
<li>Fix command descriptions in the multipathd man page.</li>
<li>Fix ISO C23 compatibility issue causing errors with new compilers.</li>
<li>Fix memory leak caused by not joining the "init unwinder" thread.</li>
<li>Fix memory leaks in kpartx.</li>
<li>Print the warning "setting scsi timeouts is unsupported for protocol" only
once per protocol.</li>
<li>Make sure multipath-tools is compiled with the compiler flag
<code>-fno-strict-aliasing</code>. (gh#opensvc/multipath-tools#130, bsc#1255285)</li>
<li>Version 0.10.5+213+suse.04c3a0ac:</li>
<li>Log offline path state if "log_checker_err always" is set</li>
<li>mpathpersist: Fix REPORT CAPABILITIES output</li>
<li>Version 0.10.5+190+suse.a9f87040:</li>
<li>CI: GitHub workflow updates. No code changes.</li>
<li>_service: switched to tar_scm for git LFS.</li>
<li>Version 0.10.5+125+suse.1ed79487:</li>
<li>Fixes from upstream 0.10.5 (see also NEWS.md) (bsc#1253260)<ul>
<li>Improved the communication with <strong>udev</strong> and <strong>systemd</strong> by triggering
uevents when path devices are added to or removed from multipath maps,
or when <code>multipathd reconfigure</code> is executed after changing blacklist
directives in <code>multipath.conf</code>.</li>
<li>Failed paths should be checked every <code>polling_interval</code>. In certain cases,
this wouldn't happen, because the check interval wasn't reset by multipathd.</li>
<li>It could happen that multipathd would accidentally release a SCSI persistent
reservation held by another node. Fix it.</li>
<li>After manually failing some paths and then reinstating them, sometimes
the reinstated paths were immediately failed again by multipathd. Fix it.</li>
<li>Various minor fixes reported by coverity.</li>
</ul>
</li>
<li>Version 0.10.3+124+suse.ed5b4b11:</li>
<li>multipath-tools: add HPE MSA Gen7 (2070/2072) to hwtable (bsc#1246501)</li>
<li>Version 0.10.2+123+suse.48d66ee8:</li>
<li>multipathd: cli_reinstate(): avoid reinstated paths being failed again
(bsc#1244917)</li>
<li>Version 0.10.2+122+suse.51e02cc:</li>
<li>multipathd: fix hang during shutdown with queuing maps
(bsc#1238484).</li>
<li>This adds multipathd-queueing.service.</li>
<li>Version 0.10.2+117+suse.33411aa:</li>
<li>multipathd: trigger uevents for blacklisted paths in reconfigure
(bsc#1236321)</li>
<li>Make sure maps are reloaded in the path checker loop after detecting an
inconsistent or wrong kernel state (bsc#1236392)</li>
<li>Make sure udev and systemd notice changes in multipath path state
when devices are added to or removed from multipath maps (bsc#1236321)</li>
<li>Fix the problem that <code>group_by_tpg</code> might be disabled if one or more
paths were offline during initial configuration (bsc#1236392)</li>
<li>Fix multipathd crash because of invalid path group index value, for example
if an invalid path device was removed from a map.
(gh#opensvc/multipath-tools#105, bsc#1236392)</li>
<li>Fixed a memory leak in the nvme foreign library.</li>
<li>Fixed a problem in the marginal path detection algorithm that could cause
the io error check for a recently failed path to be delayed.
(bsc#1236390)</li>
<li>Reduce log level of harmless "map ... doesn't exist" message</li>
<li>Version 0.10.1~2+112+suse.b66763a:</li>
<li>libmultipath: reduce log level of "map X has multiple targets"
(bsc#1233588)</li>
<li>Version 0.10.1~1+113+suse.d6eca5e:</li>
<li>This is a pre-release of the upstream stable release 0.10.1.</li>
<li>libmultipath: dm_get_maps(): don't bail out for single-map failures
(bsc#1233588, gh#opensvc/multipath-tools#102)</li>
<li>libmultipath: don't print error message if WATCHDOG_USEC is 0
(bsc#1232227)</li>
<li>libmultipath: don't set dev_loss_tmo to 0 for NO_PATH_RETRY_FAIL</li>
<li>multipathd: fix deferred_failback_tick for reload removes</li>
<li>Version 0.10.0+108+suse.2c2e597:</li>
<li>Update fix for bsc#1232063 to upstream-accepted solution</li>
<li>Version 0.10.0+106+suse.ffbdb7a:</li>
<li>Fix reboot hang if uevent is processed for suspended device
(bsc#1232063)</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Micro 6.1
<br/>
<code>zypper in -t patch SUSE-SLE-Micro-6.1-652=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Micro 6.1 (aarch64 ppc64le s390x x86_64)
<ul>
<li>multipath-tools-debuginfo-0.10.7~1+211+suse.18f1559-slfo.1.1_1.1</li>
<li>kpartx-debuginfo-0.10.7~1+211+suse.18f1559-slfo.1.1_1.1</li>
<li>multipath-tools-0.10.7~1+211+suse.18f1559-slfo.1.1_1.1</li>
<li>libmpath0-debuginfo-0.10.7~1+211+suse.18f1559-slfo.1.1_1.1</li>
<li>kpartx-0.10.7~1+211+suse.18f1559-slfo.1.1_1.1</li>
<li>libmpath0-0.10.7~1+211+suse.18f1559-slfo.1.1_1.1</li>
<li>multipath-tools-debugsource-0.10.7~1+211+suse.18f1559-slfo.1.1_1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1232063">https://bugzilla.suse.com/show_bug.cgi?id=1232063</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1232227">https://bugzilla.suse.com/show_bug.cgi?id=1232227</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1233588">https://bugzilla.suse.com/show_bug.cgi?id=1233588</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236321">https://bugzilla.suse.com/show_bug.cgi?id=1236321</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236390">https://bugzilla.suse.com/show_bug.cgi?id=1236390</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1236392">https://bugzilla.suse.com/show_bug.cgi?id=1236392</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1238484">https://bugzilla.suse.com/show_bug.cgi?id=1238484</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1244917">https://bugzilla.suse.com/show_bug.cgi?id=1244917</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1246501">https://bugzilla.suse.com/show_bug.cgi?id=1246501</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1253260">https://bugzilla.suse.com/show_bug.cgi?id=1253260</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1254094">https://bugzilla.suse.com/show_bug.cgi?id=1254094</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1255285">https://bugzilla.suse.com/show_bug.cgi?id=1255285</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257007">https://bugzilla.suse.com/show_bug.cgi?id=1257007</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257153">https://bugzilla.suse.com/show_bug.cgi?id=1257153</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257244">https://bugzilla.suse.com/show_bug.cgi?id=1257244</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1257476">https://bugzilla.suse.com/show_bug.cgi?id=1257476</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268144">https://bugzilla.suse.com/show_bug.cgi?id=1268144</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1268145">https://bugzilla.suse.com/show_bug.cgi?id=1268145</a>
</li>
</ul>
</div>