{"id":"CVE-2026-91758","kind":"vulnerability","aliases":["CVE-2026-91758"],"related":[],"title":"Hitachi Dynamic Link Manager for Linux: out-of-bounds read and write flaw","description":"Out-of-bounds Read and Write Vulnerability in Hitachi Dynamic Link Manager for Linux.\n\nThis issue affects Hitachi Dynamic Link Manager for Linux: from 7.5.0-00 before 9.0.5-00.","summary":"Hitachi Dynamic Link Manager for Linux, a multipath tool for storage access, has an out-of-bounds read and write flaw in versions from 7.5.0-00 before 9.0.5-00. The sources do not say what an attacker gets beyond memory corruption, so the impact is rated from the reported CVSS 7.8.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dynamic-link-manager","hitachi","infrastructure","linux"],"not_affected_if":["version-9.0.5-00-or-later"],"how_to_check":"- Check the installed Dynamic Link Manager for Linux version on the host; the sources do not name the exact command.","fix":"- Move to `9.0.5-00` or later, per the affected range in the NVD description.","status":"open","published_at":"2026-11-10T05:18:14+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","triaged_at":"2026-11-10T05:22:17+00:00","updated_at":"2026-11-10T05:22:17+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T05:22:17Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `9.0.5-00` or later, per the affected range in the NVD description.","reach":"unknown","title":"Hitachi Dynamic Link Manager for Linux: out-of-bounds read and write flaw","impact":"high","summary":"Hitachi Dynamic Link Manager for Linux, a multipath tool for storage access, has an out-of-bounds read and write flaw in versions from 7.5.0-00 before 9.0.5-00. The sources do not say what an attacker gets beyond memory corruption, so the impact is rated from the reported CVSS 7.8.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hitachi","dynamic-link-manager","linux"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; memory corruption in a privileged storage path","analyst_note":"Check the Hitachi vendor security advisory for the exact trigger, privilege needed, and the check command; the NVD entry alone does not say.","how_to_check":"- Check the installed Dynamic Link Manager for Linux version on the host; the sources do not name the exact command.\n- Unknown whether a non-default configuration is needed to trigger the flaw.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-9.0.5-00-or-later"],"who_is_affected":"Teams running Hitachi Dynamic Link Manager for Linux from 7.5.0-00 before 9.0.5-00 on Linux servers are exposed. The sources do not say whether network reach or a logged-in account is required, or which configurations are vulnerable.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000758,"input_tokens":4540,"output_tokens":608,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-00':54B,57B,106C,109C '-2026':16A,19A '-91758':17A,20A '7.5.0':53B,105C '7.8':79B '9.0.5':56B,108C 'access':39B 'affect':97C 'attack':65B 'beyond':67B 'bound':10A,45B,83C 'corrupt':69B 'cve':15A,18A 'cvss':78B 'dynam':2A,22B,29B,90C,99C 'dynamic-link-manag':21B 'flaw':14A,49B 'get':66B 'hitachi':1A,25B,28B,89C,98C 'impact':72B 'infrastructur':26B 'issu':96C 'link':3A,23B,30B,91C,100C 'linux':6A,27B,33B,94C,103C 'manag':4A,24B,31B,92C,101C 'memori':68B 'multipath':35B 'out-of-bound':7A,42B,80C 'rate':74B 'read':11A,46B,84C 'report':77B 'say':62B 'sourc':59B 'storag':38B 'tool':36B 'version':51B 'vulner':87C 'write':13A,48B,86C","nicknames":[],"mitigations":[],"who_affected":"Teams running Hitachi Dynamic Link Manager for Linux from 7.5.0-00 before 9.0.5-00 on Linux servers are exposed. The sources do not say whether network reach or a logged-in account is required, or which configurations are vulnerable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dynamiclinkmanager","high","hitachi","infrastructure","linux"],"campaign_type":null,"search_a":"'-2026':16A,19A '-91758':17A,20A 'bound':10A 'cve':15A,18A 'dynam':2A 'flaw':14A 'hitachi':1A 'link':3A 'linux':6A 'manag':4A 'out-of-bound':7A 'read':11A 'write':13A","search_b":"'-00':54B,57B '7.5.0':53B '7.8':79B '9.0.5':56B 'access':39B 'attack':65B 'beyond':67B 'bound':45B 'corrupt':69B 'cvss':78B 'dynam':22B,29B 'dynamic-link-manag':21B 'flaw':49B 'get':66B 'hitachi':25B,28B 'impact':72B 'infrastructur':26B 'link':23B,30B 'linux':27B,33B 'manag':24B,31B 'memori':68B 'multipath':35B 'out-of-bound':42B 'rate':74B 'read':46B 'report':77B 'say':62B 'sourc':59B 'storag':38B 'tool':36B 'version':51B 'write':48B","search_c":"'-00':106C,109C '7.5.0':105C '9.0.5':108C 'affect':97C 'bound':83C 'dynam':90C,99C 'hitachi':89C,98C 'issu':96C 'link':91C,100C 'linux':94C,103C 'manag':92C,101C 'out-of-bound':80C 'read':84C 'vulner':87C 'write':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T05:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91758","severity":null,"published_at":"2026-11-10T05:18:14+00:00","modified_at":"2026-11-10T05:18:14+00:00","first_seen_at":"2026-11-10T05:19:58+00:00","fetched_at":"2026-11-10T05:19:58+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}