xfsprogs xfs_admin: Local privilege escalation via command injection
Summary
The xfs_admin utility in xfsprogs, the userspace tools for the XFS filesystem, does not properly validate user-supplied parameters, which allows operating system command injection. A local attacker who can supply parameters to xfs_admin can run arbitrary commands with the privileges of the executing process, which may lead to local privilege escalation. Impact depends on how xfs_admin is invoked; on standard Red Hat Enterprise Linux installations the tool is restricted to administrative accounts.
Affected
- Red Hat Enterprise Linux 7, 8, 9 and 10 (default: affected)
- Red Hat OpenShift Container Platform 4 and 5 (default: affected)
- Upstream xfsprogs version range: Unknown.
Fixed in
Unknown. No vendor fix has been confirmed at the time of writing.
Workaround
- Do not pass untrusted or user-controlled input to xfs_admin.
- Restrict who can run xfs_admin, and review sudo rules and scripts that call it.
- Red Hat states that no mitigation is currently available that meets its criteria.
Exploitation
- No confirmed exploitation in the wild.
- No public proof-of-concept or exploit code found.
- Not listed in CISA KEV.
Our recommendation
- Inventory hosts with xfsprogs and identify where xfs_admin is run.
- Review sudo rules, scripts and automation that pass external or user-controlled values to xfs_admin.
- Restrict xfs_admin use to trusted administrators.
- Monitor the Red Hat CVE page and errata for a fix and apply it once released.
- Verify the status directly on the Red Hat CVE page, as the NVD analysis is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-108472 access.redhat.com
- Red Hat Bugzilla 2548925 bugzilla.redhat.com
- CVE.org record CVE-2026-108472 www.cve.org
- Debian manpage xfs_admin(8) manpages.debian.org
- Debian tracker xfsprogs tracker.debian.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:30.
Original description (NVD)
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.
NVD references (8)
- https://access.redhat.com/errata/RHSA-2026:99659
- https://access.redhat.com/errata/RHSA-2026:99660
- https://access.redhat.com/errata/RHSA-2026:99661
- https://access.redhat.com/errata/RHSA-2026:99662
- https://access.redhat.com/errata/RHSA-2026:99817
- https://access.redhat.com/security/cve/CVE-2026-108472
- https://bugzilla.redhat.com/show_bug.cgi?id=2548925
- http://www.openwall.com/lists/oss-security/2026/11/11/27
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.