What happened
A vulnerability has been identified in device-mapper-multipath, which affects multiple versions of Red Hat Enterprise Linux (including versions 6 through 10) and Red Hat OpenShift Container Platform 4. The flaw, assigned CVE-2026-114038, allows a local user to trigger an out-of-bounds read by sending a malicious command with a format string ending in a trailing percent character to the multipath daemon. This exploits a weakness in the handling of certain command formats, potentially exposing unintended memory areas of the daemon or causing it to crash. The consequence can be information disclosure or a denial of service (DoS). The vulnerability’s severity is assessed as medium due to its partial impact and the requirement of local access to exploit the flaw. Exploitation does not require prior access or user interaction, but it assumes the attacker already has local access to the affected host or device. This situation underscores the importance of privilege hygiene and endpoint monitoring to mitigate potential risks.
Who is affected
Organisations running impacted versions of Red Hat Enterprise Linux (6 through 10) or Red Hat OpenShift Container Platform 4 are affected by this vulnerability. Any deployment where device-mapper-multipath is installed and actively used may be vulnerable to exploitation if local attacker access exists. Systems that do not provide strict access controls or that lack proper endpoint security measures may be at higher risk of exploitation through this flaw. At present, there is no information indicating remote exploitation or active exploits in the wild, but the potential for local information disclosure or DoS remains a concern.
Recommended actions
- Improve privilege hygiene by restricting local user access where possible to reduce the risk of exploitation in affected environments.
- Implement comprehensive endpoint monitoring to detect unusual activities or attempts to exploit this vulnerability on hosts and devices.
- Review access controls to minimise local user privileges, especially for users with administrative or system-level access.
- Monitor security advisories for updates related to device-mapper-multipath and plan for any relevant patches or mitigations as they become available.
