CVE-2026-108472: Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin
Published Oct 9, 2026
·Updated
A flaw was found in the xfsadmin utility in xfsprogs. The tool does n ...
Other sources
xfsadmin lacks user-controlled input validation for its parameters, this can lead to OS command injection or, depending on how xfsadmin is being executed, to a local privilege escalation.
— Red Hat
Affected Software
4 affected components
debian/xfsprogs*
debian/xfsprogs*
debian/xfsprogs*
debian/xfsprogs<=6.1.0-1, <=6.13.0-2+deb13u1, <=7.2.0-1
Event History
Oct 9, 2026
Data Sourced
via Red Hat·10:48 PM
DescriptionSeverityAffected Software
Nov 11, 2026
CVE Published
via MITRE·06:38 PM
Data Sourced
via MITRE·06:38 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness
Data Sourced
via OSV·07:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does exploitation require remote access or user interaction?
No. The issue has a local attack vector and requires no user interaction. An attacker needs low-level privileges to supply crafted arguments to xfs_admin.
2
When can this lead to privilege escalation?
The crafted arguments can trigger arbitrary operating system command execution. Privilege escalation depends on the privileges and execution context in which xfs_admin is run.