Root escalation via repeated-keyword fingerprint collision

Authorization bypass in multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to execute privileged daemon commands. The multipathd command parser creates handler fingerprints by arithmetically adding keyword bit values, so repeated LIST keywords collide with privileged command fingerprints. Access to the local abstract UNIX socket is required; the bypass exposes 34 root-level handlers and enables root escalation when chained with another local flaw.