CVE-2026-89329Medium· 6.2▾ SunlitA flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the `multipathd` list…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
0.1% → 0.2%
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114038Medium· 5.1Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string
CVE-2026-19484High· 7.5fastify/busboy: fastify/busboy: Denial of Service via oversized multipart boundary (CVE-2026-19484)
CVE-2026-117574Critical· 9.1Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization
CVE-2026-13451High· 7.7Kserve: kserve: server-side request forgery via malicious storageuri
CVE-2026-84725High· 8.1Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap
CVE-2026-116497Medium· 5.5Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon