{"id":"UBUNTU-CVE-2026-114038","details":"(A flaw was found in device-mapper-multipath. A local user can trigger ...)","modified":"2026-10-27T04:17:33.830654841Z","published":"2026-10-23T00:00:00Z","upstream":["CVE-2026-114038"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-114038"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-114038"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469787"},{"type":"REPORT","url":"https://github.com/opensvc/multipath-tools/commit/d75d74f1d344cab8a98258773b85dbffa6895902"}],"affected":[{"package":{"name":"multipath-tools","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/multipath-tools?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.9-3ubuntu7","0.4.9-3ubuntu7.2","0.4.9-3ubuntu7.4","0.4.9-3ubuntu7.6","0.4.9-3ubuntu7.7","0.4.9-3ubuntu7.9","0.4.9-3ubuntu7.11","0.4.9-3ubuntu7.12","0.4.9-3ubuntu7.13","0.4.9-3ubuntu7.14","0.4.9-3ubuntu7.15","0.4.9-3ubuntu7.16"],"ecosystem_specific":{"binaries":[{"binary_name":"kpartx","binary_version":"0.4.9-3ubuntu7.16"},{"binary_version":"0.4.9-3ubuntu7.16","binary_name":"kpartx-boot"},{"binary_name":"multipath-tools","binary_version":"0.4.9-3ubuntu7.16"},{"binary_name":"multipath-tools-boot","binary_version":"0.4.9-3ubuntu7.16"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114038.json"}},{"package":{"name":"multipath-tools","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/multipath-tools?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.0-7ubuntu7","0.5.0-7ubuntu8","0.5.0-7ubuntu9","0.5.0-7ubuntu10","0.5.0-7ubuntu11","0.5.0-7ubuntu12","0.5.0-7ubuntu14","0.5.0-7ubuntu15","0.5.0-7ubuntu16","0.5.0+git1.656f8865-5ubuntu1","0.5.0+git1.656f8865-5ubuntu2","0.5.0+git1.656f8865-5ubuntu2.1","0.5.0+git1.656f8865-5ubuntu2.2","0.5.0+git1.656f8865-5ubuntu2.3","0.5.0+git1.656f8865-5ubuntu2.4","0.5.0+git1.656f8865-5ubuntu2.5"],"ecosystem_specific":{"binaries":[{"binary_name":"kpartx","binary_version":"0.5.0+git1.656f8865-5ubuntu2.5"},{"binary_name":"kpartx-boot","binary_version":"0.5.0+git1.656f8865-5ubuntu2.5"},{"binary_name":"multipath-tools","binary_version":"0.5.0+git1.656f8865-5ubuntu2.5"},{"binary_name":"multipath-tools-boot","binary_version":"0.5.0+git1.656f8865-5ubuntu2.5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114038.json"}},{"package":{"name":"multipath-tools","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/multipath-tools?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.4-5ubuntu1","0.7.4-2ubuntu1","0.7.4-2ubuntu3","0.7.4-2ubuntu3.1","0.7.4-2ubuntu3.2"],"ecosystem_specific":{"binaries":[{"binary_name":"kpartx","binary_version":"0.7.4-2ubuntu3.2"},{"binary_version":"0.7.4-2ubuntu3.2","binary_name":"kpartx-boot"},{"binary_version":"0.7.4-2ubuntu3.2","binary_name":"multipath-tools"},{"binary_version":"0.7.4-2ubuntu3.2","binary_name":"multipath-tools-boot"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114038.json"}},{"package":{"name":"multipath-tools","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/multipath-tools?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.9-3ubuntu6","0.7.9-3ubuntu7","0.8.3-1ubuntu1","0.8.3-1ubuntu2","0.8.3-1ubuntu2.1","0.8.3-1ubuntu2.2","0.8.3-1ubuntu2.3","0.8.3-1ubuntu2.4"],"ecosystem_specific":{"binaries":[{"binary_name":"kpartx","binary_version":"0.8.3-1ubuntu2.4"},{"binary_name":"kpartx-boot","binary_version":"0.8.3-1ubuntu2.4"},{"binary_name":"multipath-tools","binary_version":"0.8.3-1ubuntu2.4"},{"binary_name":"multipath-tools-boot","binary_version":"0.8.3-1ubuntu2.4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114038.json"}},{"package":{"name":"multipath-tools","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/multipath-tools?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.5-2ubuntu2","0.8.5-2ubuntu3","0.8.8-1ubuntu1","0.8.8-1ubuntu1.22.04.1","0.8.8-1ubuntu1.22.04.3","0.8.8-1ubuntu1.22.04.4"],"ecosystem_specific":{"binaries":[{"binary_version":"0.8.8-1ubuntu1.22.04.4","binary_name":"kpartx"},{"binary_version":"0.8.8-1ubuntu1.22.04.4","binary_name":"kpartx-boot"},{"binary_version":"0.8.8-1ubuntu1.22.04.4","binary_name":"multipath-tools"},{"binary_name":"multipath-tools-boot","binary_version":"0.8.8-1ubuntu1.22.04.4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114038.json"}},{"package":{"name":"multipath-tools","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/multipath-tools?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.4-5ubuntu3","0.9.4-5ubuntu6","0.9.4-5ubuntu7","0.9.4-5ubuntu8","0.9.4-5ubuntu8.1","0.9.4-5ubuntu8.2"],"ecosystem_specific":{"binaries":[{"binary_name":"kpartx","binary_version":"0.9.4-5ubuntu8.2"},{"binary_name":"kpartx-boot","binary_version":"0.9.4-5ubuntu8.2"},{"binary_name":"multipath-tools","binary_version":"0.9.4-5ubuntu8.2"},{"binary_name":"multipath-tools-boot","binary_version":"0.9.4-5ubuntu8.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114038.json"}},{"package":{"name":"multipath-tools","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/multipath-tools?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.3-2ubuntu1","0.14.3-3ubuntu1","0.14.3-3ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_name":"kpartx","binary_version":"0.14.3-3ubuntu2"},{"binary_version":"0.14.3-3ubuntu2","binary_name":"libmpathcmd0"},{"binary_name":"libmpathpersist0","binary_version":"0.14.3-3ubuntu2"},{"binary_name":"libmpathvalid0","binary_version":"0.14.3-3ubuntu2"},{"binary_name":"libmultipath0","binary_version":"0.14.3-3ubuntu2"},{"binary_name":"multipath-tools","binary_version":"0.14.3-3ubuntu2"},{"binary_version":"0.14.3-3ubuntu2","binary_name":"multipath-tools-boot"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114038.json"}},{"package":{"name":"multipath-tools","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/multipath-tools?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1-3ubuntu2","0.12.0-1ubuntu1","0.12.0-1ubuntu2","0.12.0-1ubuntu3","0.14.3-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.14.3-2ubuntu1","binary_name":"kpartx"},{"binary_name":"libmpathcmd0","binary_version":"0.14.3-2ubuntu1"},{"binary_version":"0.14.3-2ubuntu1","binary_name":"libmpathpersist0"},{"binary_name":"libmpathvalid0","binary_version":"0.14.3-2ubuntu1"},{"binary_name":"libmultipath0","binary_version":"0.14.3-2ubuntu1"},{"binary_name":"multipath-tools","binary_version":"0.14.3-2ubuntu1"},{"binary_name":"multipath-tools-boot","binary_version":"0.14.3-2ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114038.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"},{"type":"Ubuntu","score":"medium"}]}