CVE-2022-41973: Debian Linux

High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days.

multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 36 only
• Opensvc Multipath-Tools: from 0.7.7, before 0.9.2 (fixed in 0.9.2)

Published 2022-10-29. Last modified 2026-06-17.