CVE-2026-89329: multipathd IPC Socket DOS Vulnerability

CVE-2026-89329 Overview

CVE-2026-89329 is a Denial of Service (DoS) vulnerability in multipathd, the multipath device management daemon commonly used on Linux systems. A local attacker with access to the multipathd UNIX control socket can send valid commands and then stop reading replies. This causes the multipathd listener thread to block, preventing legitimate Inter-Process Communication (IPC) operations from completing.

The flaw is tracked under [CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context]. It does not enable privilege escalation, arbitrary code execution, or affect data confidentiality or integrity. Impact is limited to availability of multipathd IPC services.

Critical Impact
A local, unauthenticated caller on the control socket can hang the multipathd listener thread, causing legitimate IPC operations to hang or time out.

Affected Products

multipathd daemon (device-mapper-multipath) on Linux distributions
Red Hat Enterprise Linux distributions shipping multipathd (see Red Hat CVE-2026-89329 Advisory)
Systems exposing the multipathd UNIX control socket to local users

Discovery Timeline

2026-09-11 - CVE-2026-89329 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in the NVD database

Technical Details for CVE-2026-89329

Vulnerability Analysis

The multipathd daemon exposes a UNIX domain control socket used by administrative tools and internal components to send commands and receive replies. The listener thread handles these client connections serially. When a client submits a valid command, the daemon writes the response back on the same socket.

The vulnerability arises because the listener thread performs a blocking write when returning replies. A client that submits valid commands and then stops reading data from its end of the socket causes the kernel send buffer to fill. The subsequent write in multipathd blocks indefinitely, stalling the listener thread.

While the listener is blocked, other IPC clients cannot be serviced. Administrative tools that rely on multipathd communication may hang or time out, degrading storage management operations. The daemon itself does not crash, and no memory corruption occurs.

Root Cause

The root cause is the use of blocking I/O in a single-threaded IPC listener context, matching the pattern described by [CWE-1322]. The reply path does not enforce a write timeout, use non-blocking sockets, or offload responses to a worker, so a slow or stalled reader controls the pace of the listener thread.

Attack Vector

Exploitation requires local access and the ability to connect to the multipathd UNIX control socket. The attacker connects, sends one or more valid commands, and refuses to read the responses. No authentication credentials or user interaction are required beyond socket access. The attack impacts availability only, consistent with the CVSS scope: local vector, low complexity, no privileges required, high availability impact.

For technical details, see the Red Hat Bug Report #2470013.

Detection Methods for CVE-2026-89329

Indicators of Compromise

Long-lived client connections to the multipathd UNIX control socket that never read reply data.
multipathd commands from tools such as multipathd -k or multipath that hang or time out.
Growth in the kernel send buffer for the multipathd socket observed via ss -x or lsof.
Absence of new log entries from the multipathd listener thread while the process remains running.

Detection Strategies

Monitor process state of the multipathd listener thread for prolonged D or blocking states using ps -eLo pid,tid,stat,comm.
Audit local processes with open handles to the multipathd control socket using lsof -U and correlate with unexpected UIDs.
Track failed or timed-out multipath administrative commands in system journals and SAN management tooling.

Monitoring Recommendations

Alert on multipath command timeouts logged by systemd, journald, or storage automation scripts.
Baseline expected clients of the multipathd socket and flag connections from unexpected user contexts.
Track availability metrics for storage operations dependent on multipath and page on sustained failure of IPC calls.

How to Mitigate CVE-2026-89329

Immediate Actions Required

Restrict local access to hosts running multipathd, especially systems where untrusted users have shell access.
Verify filesystem permissions on the multipathd control socket so that only intended administrative accounts can connect.
Monitor for hung multipathd IPC operations and restart the service when the listener thread is confirmed blocked.
Apply vendor updates as soon as they are published in the Red Hat CVE-2026-89329 Advisory.

Patch Information

At the time of publication, refer to the Red Hat CVE-2026-89329 Advisory and the associated Red Hat Bug Report #2470013 for the current fix status and available package updates for the device-mapper-multipath component. Apply distribution-provided packages when released and restart multipathd to activate the fix.

Workarounds

Limit membership of any group that owns or can access the multipathd UNIX control socket to trusted administrators.
Prevent untrusted local users from running on hosts that expose multipathd IPC, including shared jump hosts and multi-tenant systems.
Configure monitoring to restart multipathd if IPC command timeouts persist beyond a defined threshold, restoring service availability until a patch is applied.

bash

# Inspect ownership and permissions of the multipathd control socket
ls -l /run/multipathd/multipathd.sock

# List local processes with open handles to the multipathd socket
sudo lsof -U | grep multipathd

# Restart multipathd to clear a blocked listener thread
sudo systemctl restart multipathd