{"id":"SUSE-SU-2026:23160-1","summary":"Security update for multipath-tools","details":"This update for multipath-tools fixes the following issues:\n\nUpdate to version 0.10.7~1+211+suse.18f1559.\n\nSecurity issues fixed:\n\n- kpartx: integer overflow in the GPT partition table size calculation can lead to heap OOB read via crafted USB device\n  or disk image(bsc#1268145).\n- kpartx: missing bounds check can lead to a DASD VOL1 unbounded array write via a crafted DASD disk with more than 256\n  consecutive format labels (bsc#1268144).\n\nOther updates and bugfixes:\n\n- Fix system with multipath failing to boot during first boot during the installation (bsc#1232063).\n- Fix code that leads to `is_bit_set_in_bitfield: bitfield overflow: 1 \u003e= 0` message showing up in syslog\n  (bsc#1255285).\n- Version 0.10.7~1+211+suse.18f1559:\n  * Fix ALUA asymmetric access state descriptions in multipathd logs, so that\n    the same terms are used as by the kernel (\"lba-dependent\", \"transitioning\").\n  * Don't set a hardware handler for bio-based multipath devices. The kernel\n    rejects this anyway.\n  * Fix WWID detection for legacy devices that use the older SCSI-2 VPD page\n    0x83 format for their device identifier.\n  * Fix duplicate \"checker timed out\" log messages when `log_checker_err` is\n    set to `once`. (bsc#1254094)\n  * Avoid potential buffer overflows in the iet and datacore prioritizers.\n  * iet prioritizer: avoid misleading error message with systemd 256 and\n    newer, and properly use udev to derive path parameters.\n    (gh#opensvc/multipath-tools#145)\n- Version 0.10.6+201+suse.9f189e79:\n  * libmultipath: reduce log level of \"map X has no targets\" (bsc#1257476)\n- Version 0.10.6+200+suse.547788f4 (bsc#1257007):\n  * kpartx: fix segfault when operating on regular files (bsc#1257244, bsc#1257153)\n  * multipathd: print path offline message even without a checker\n    (bsc#1254094)\n  * Fix command descriptions in the multipathd man page.\n  * Fix ISO C23 compatibility issue causing errors with new compilers.\n  * Fix memory leak caused by not joining the \"init unwinder\" thread.\n  * Fix memory leaks in kpartx.\n  * Print the warning \"setting scsi timeouts is unsupported for protocol\" only\n    once per protocol.\n  * Make sure multipath-tools is compiled with the compiler flag\n    `-fno-strict-aliasing`. (gh#opensvc/multipath-tools#130, bsc#1255285)\n- Version 0.10.5+213+suse.04c3a0ac:\n  * Log offline path state if \"log_checker_err always\" is set\n  * mpathpersist: Fix REPORT CAPABILITIES output\n- Version 0.10.5+190+suse.a9f87040:\n  * CI: GitHub workflow updates. No code changes.\n- _service: switched to tar_scm for git LFS.\n- Version 0.10.5+125+suse.1ed79487:\n  - Fixes from upstream 0.10.5 (see also NEWS.md) (bsc#1253260)\n    * Improved the communication with **udev** and **systemd** by triggering\n      uevents when path devices are added to or removed from multipath maps,\n      or when `multipathd reconfigure` is executed after changing blacklist\n      directives in `multipath.conf`.\n    * Failed paths should be checked every `polling_interval`. In certain cases,\n      this wouldn't happen, because the check interval wasn't reset by multipathd.\n    * It could happen that multipathd would accidentally release a SCSI persistent\n      reservation held by another node. Fix it.\n    * After manually failing some paths and then reinstating them, sometimes\n      the reinstated paths were immediately failed again by multipathd. Fix it.\n    * Various minor fixes reported by coverity.\n- Version 0.10.3+124+suse.ed5b4b11:\n  * multipath-tools: add HPE MSA Gen7 (2070/2072) to hwtable (bsc#1246501)\n- Version 0.10.2+123+suse.48d66ee8:\n  * multipathd: cli_reinstate(): avoid reinstated paths being failed again\n    (bsc#1244917)\n- Version 0.10.2+122+suse.51e02cc:\n  * multipathd: fix hang during shutdown with queuing maps\n    (bsc#1238484).\n  * This adds multipathd-queueing.service.\n- Version 0.10.2+117+suse.33411aa:\n  * multipathd: trigger uevents for blacklisted paths in reconfigure\n    (bsc#1236321)\n  * Make sure maps are reloaded in the path checker loop after detecting an\n    inconsistent or wrong kernel state (bsc#1236392)\n  * Make sure udev and systemd notice changes in multipath path state\n    when devices are added to or removed from multipath maps (bsc#1236321)\n  * Fix the problem that `group_by_tpg` might be disabled if one or more\n    paths were offline during initial configuration (bsc#1236392)\n  * Fix multipathd crash because of invalid path group index value, for example\n    if an invalid path device was removed from a map.\n    (gh#opensvc/multipath-tools#105, bsc#1236392)\n  * Fixed a memory leak in the nvme foreign library.\n  * Fixed a problem in the marginal path detection algorithm that could cause\n    the io error check for a recently failed path to be delayed.\n    (bsc#1236390)\n  * Reduce log level of harmless \"map ... doesn't exist\" message\n- Version 0.10.1~2+112+suse.b66763a:\n  * libmultipath: reduce log level of \"map X has multiple targets\"\n    (bsc#1233588)\n- Version 0.10.1~1+113+suse.d6eca5e:\n  * This is a pre-release of the upstream stable release 0.10.1.\n  * libmultipath: dm_get_maps(): don't bail out for single-map failures\n    (bsc#1233588, gh#opensvc/multipath-tools#102)\n  * libmultipath: don't print error message if WATCHDOG_USEC is 0\n    (bsc#1232227)\n  * libmultipath: don't set dev_loss_tmo to 0 for NO_PATH_RETRY_FAIL\n  * multipathd: fix deferred_failback_tick for reload removes\n- Version 0.10.0+108+suse.2c2e597:\n  * Update fix for bsc#1232063 to upstream-accepted solution\n- Version 0.10.0+106+suse.ffbdb7a:\n  * Fix reboot hang if uevent is processed for suspended device\n    (bsc#1232063)\n","modified":"2026-08-22T18:23:34.424141426Z","published":"2026-08-04T11:05:20Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623160-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1232063"},{"type":"REPORT","url":"https://bugzilla.suse.com/1232227"},{"type":"REPORT","url":"https://bugzilla.suse.com/1233588"},{"type":"REPORT","url":"https://bugzilla.suse.com/1236321"},{"type":"REPORT","url":"https://bugzilla.suse.com/1236390"},{"type":"REPORT","url":"https://bugzilla.suse.com/1236392"},{"type":"REPORT","url":"https://bugzilla.suse.com/1238484"},{"type":"REPORT","url":"https://bugzilla.suse.com/1244917"},{"type":"REPORT","url":"https://bugzilla.suse.com/1246501"},{"type":"REPORT","url":"https://bugzilla.suse.com/1253260"},{"type":"REPORT","url":"https://bugzilla.suse.com/1254094"},{"type":"REPORT","url":"https://bugzilla.suse.com/1255285"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257007"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257153"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257244"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257476"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268144"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268145"}],"affected":[{"package":{"name":"multipath-tools","ecosystem":"SUSE:Linux Micro 6.1","purl":"pkg:rpm/suse/multipath-tools&distro=SUSE%20Linux%20Micro%206.1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.7~1+211+suse.18f1559-slfo.1.1_1.1"}]}],"ecosystem_specific":{"binaries":[{"kpartx":"0.10.7~1+211+suse.18f1559-slfo.1.1_1.1","libmpath0":"0.10.7~1+211+suse.18f1559-slfo.1.1_1.1","multipath-tools":"0.10.7~1+211+suse.18f1559-slfo.1.1_1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23160-1.json"}}],"schema_version":"1.9.0"}