CVE-2026-108472
Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.
- Record
CVE-2026-108472- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-12
EUVDEUVD-2026-123708
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.
- Record
EUVD-2026-123708- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
GitHub AdvisoriesGHSA-7g9v-wrq3-g54m
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user...
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.
- Record
GHSA-7g9v-wrq3-g54m- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-13
NVD
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.
- Record
CVE-2026-108472- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-12
OSVDEBIAN-CVE-2026-108472
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.
- Record
DEBIAN-CVE-2026-108472- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-12
OSVUBUNTU-CVE-2026-108472No score
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.
- Record
UBUNTU-CVE-2026-108472- Updated
- 2026-11-13
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xfsprogsDebian:12 | All versions, plus listed versions 6.1.0-16.10.1-16.11.0-16.12.0-16.13.0-1 Show 24 moreShow less6.13.0-26.14.0-16.15.0-16.16.0-16.17.0-16.17.0-26.18.0-16.18.0-26.18.0-36.18.0-46.18.0-56.19.0-16.3.0-16.4.0-16.5.0-16.6.0-16.7.0-16.7.0-26.7.0-36.8.0-16.8.0-26.8.0-2.16.8.0-2.27.2.0-1 | None known |
xfsprogsDebian:13 | All versions, plus listed versions 6.13.0-26.13.0-2+deb13u16.14.0-16.15.0-16.16.0-1 Show 9 moreShow less6.17.0-16.17.0-26.18.0-16.18.0-26.18.0-36.18.0-46.18.0-56.19.0-17.2.0-1 | None known |
xfsprogsDebian:14 | All versions, plus listed versions 6.13.0-26.14.0-16.15.0-16.16.0-16.17.0-1 Show 8 moreShow less6.17.0-26.18.0-16.18.0-26.18.0-36.18.0-46.18.0-56.19.0-17.2.0-1 | None known |
xfsprogsUbuntu:14.04:LTS | All versions, plus listed versions 3.1.9ubuntu13.1.9ubuntu23.1.9ubuntu2.1 | None known |
xfsprogsUbuntu:16.04:LTS | All versions, plus listed versions 3.2.1ubuntu14.2.04.3.04.3.0+nmu14.3.0+nmu1ubuntu14.3.0+nmu1ubuntu1.1 | None known |
xfsprogsUbuntu:18.04:LTS | All versions, plus listed versions 4.9.0+nmu1ubuntu14.9.0+nmu1ubuntu2 | None known |
xfsprogsUbuntu:20.04:LTS | All versions, plus listed versions 5.0.0-1ubuntu15.2.1-1ubuntu15.3.0-1ubuntu15.3.0-1ubuntu25.3.0-1ubuntu2.1 | None known |
xfsprogsUbuntu:22.04:LTS | All versions, plus listed versions 5.10.0-4ubuntu25.13.0-1ubuntu15.13.0-1ubuntu25.13.0-1ubuntu2.15.13.0-1ubuntu2.2 | None known |
xfsprogsUbuntu:24.04:LTS | All versions, plus listed versions 6.3.0-1ubuntu16.5.0-16.5.0-1ubuntu16.5.0-1ubuntu26.6.0-1ubuntu16.6.0-1ubuntu26.6.0-1ubuntu2.1 | None known |
xfsprogsUbuntu:26.10 | All versions, plus listed versions 6.18.0-36.19.0-1 | None known |
xfsprogsUbuntu:26.04:LTS | All versions, plus listed versions 6.13.0-2ubuntu26.16.0-16.17.0-26.18.0-3 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | EUVD, OSV | |
| products, references | CVE List | |
| references | CVE List, EUVD, GitHub Advisories, NVD | |
| products, references | CVE List, NVD, OSV | |
| references | GitHub Advisories | |
| affected, aliases, references | OSV | |
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories, NVD | |
| cwes, products, references, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-108472 is a high vulnerability (CVSS 7.8) in Red Hat Enterprise Linux 10, published November 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. No source names a fixed version.
References
access.redhat.com/errata/RHSA-2026:99659
Show 8 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2548925
openwall.com/lists/oss-security/2026/11/11/27
nvd.nist.gov/vuln/detail/CVE-2026-108472
github.com/advisories/GHSA-7g9v-wrq3-g54m
security-tracker.debian.org/tracker/CVE-2026-108472
ubuntu.com/security/CVE-2026-108472
cve.org/CVERecord?id=CVE-2026-108472
lore.kernel.org/linux-xfs/20261111151107.3884786-2-aalbersh@kernel.org/T