multipathd EUVD-2026-76186

Requires local access to the multipathd UNIX domain socket, typically located at /run/multipathd.socket. On default RHEL configurations this socket is owned by root with permissions that limit access to privileged users, meaning real-world exploitation is gated on root-level access or misconfigured socket permissions - the CVSS PR:N rating may overstate accessibility in typical deployments. multipathd must be actively running and multipath storage must be configured on the target host; the daemon is only deployed in environments using SAN, iSCSI, or NVMe-oF storage with multiple paths. The DoS requires only the ability to send a valid command and withhold reads; no memory corruption, kernel interactions, or binary exploitation are involved. The attack does not survive a daemon restart, and recovery requires no host reboot.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) yields a 6.2 medium, reflecting a local, no-privilege, high-availability-impact denial of service. The PR:N (no privileges required) rating merits scrutiny: access to the multipathd UNIX domain socket is restricted by file permissions on default RHEL configurations, typically to root or a privileged group, which would map more accurately to PR:L or PR:H rather than PR:N. If any RHEL version ships with a world-accessible socket permission, PR:N may apply in that configuration, but this is not confirmed from the provided references. No EPSS score was provided. The CVE is not listed in CISA KEV and no public POC has been identified, indicating low immediate exploitation probability. Real-world impact is context-dependent: blocking the multipathd listener thread in a SAN environment under active I/O could prevent path failover decisions, potentially cascading into storage-level application errors. However, the DoS is recoverable by restarting the daemon. The 'Privilege Escalation' and 'RCE' tags present in the input metadata are directly and explicitly contradicted by the CVE description and must not be used for risk prioritisation.

A local attacker or a compromised process with access to /run/multipathd.socket connects to the socket, transmits a well-formed multipathd control command (such as 'show maps'), and then immediately stops reading from the connection without closing it gracefully. The multipathd listener thread stalls on its attempted write-back to the unresponsive client, causing all subsequent legitimate IPC callers - storage monitoring scripts, multipath CLI tools, and OpenShift path management - to hang or time out until the daemon is manually restarted. No public proof-of-concept code has been identified.