RLSA-2026:99817: Important: xfsprogs security update
The xfsprogs packages contain a set of utilities to administer the XFS file system, including the mkfs.xfs utility to construct an XFS file system.
Security Fix(es):
xfsprogs: xfsprogs: Local privilege escalation via command injection in xfsadmin (CVE-2026-108472)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/xfsprogsto a version that resolves this vulnerability.Fixed in 0:5.0.0-13.el8_10 - Upgrade
Upgrade
rocky-linux/xfsprogs-debuginfoto a version that resolves this vulnerability.Fixed in 0:5.0.0-13.el8_10 - Upgrade
Upgrade
rocky-linux/xfsprogs-debugsourceto a version that resolves this vulnerability.Fixed in 0:5.0.0-13.el8_10 - Upgrade
Upgrade
rocky-linux/xfsprogs-develto a version that resolves this vulnerability.Fixed in 0:5.0.0-13.el8_10
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires local access and low privileges. The CVSS vector indicates no user interaction is required, and successful exploitation can result in high impact to confidentiality, integrity, and availability.
What component is affected by the command injection?
The issue is identified as a command injection vulnerability in xfs_admin, part of the xfsprogs utilities used to administer XFS file systems.
Which Rocky Linux packages are covered by this advisory?
The advisory covers rocky-linux/xfsprogs, rocky-linux/xfsprogs-debuginfo, rocky-linux/xfsprogs-debugsource, and rocky-linux/xfsprogs-devel.