xfs_admin: OS command injection

Red Hat Enterprise Linux 10

A flaw in the xfs_admin utility allows OS command injection and local privilege escalation.

Do this now

Install the update for your version: Red Hat Enterprise Linux 10 → 0:6.16.0-2.el10_3; Red Hat Enterprise Linux 10.2 Extended Update Support → 0:6.16.0-2.el10_2; Red Hat Enterprise Linux 9 → 0:6.4.0-10.el9_9 (+2 more lines in Fix it).

Who should check: teams running Linux kernel

Fix it

Red Hat Enterprise Linux 10

Upgrade to Red Hat Enterprise Linux 10 0:6.16.0-2.el10_3

Red Hat Enterprise Linux 10.2 Extended Update Support

Upgrade to Red Hat Enterprise Linux 10.2 Extended Update Support 0:6.16.0-2.el10_2

Red Hat Enterprise Linux 8

Upgrade to Red Hat Enterprise Linux 8 0:5.0.0-13.el8_10

Red Hat Enterprise Linux 9

Upgrade to Red Hat Enterprise Linux 9 0:6.4.0-10.el9_9

Red Hat Enterprise Linux 9.8 Extended Update Support

Upgrade to Red Hat Enterprise Linux 9.8 Extended Update Support 0:6.4.0-8.el9_8

First seen: 11 Nov 2026
Last update: 12 Nov 2026, 23:18 UTC
Fixed in: Red Hat Enterprise Linux 10 0:6.16.0-2.el10_3
Red Hat Enterprise Linux 10.2 Extended Update Support 0:6.16.0-2.el10_2
Red Hat Enterprise Linux 8 0:5.0.0-13.el8_10
Red Hat Enterprise Linux 9 0:6.4.0-10.el9_9
Red Hat Enterprise Linux 9.8 Extended Update Support 0:6.4.0-8.el9_8
Identifiers: CVE-2026-108472
CVSS: 7.8
Source: news
On the menu as: Linux kernel

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## xfs_admin: OS command injection
Severity: high. Patch status: patched.
Affected: Red Hat Enterprise Linux 10
Fixed in: Red Hat Enterprise Linux 10 0:6.16.0-2.el10_3, Red Hat Enterprise Linux 10.2 Extended Update Support 0:6.16.0-2.el10_2, Red Hat Enterprise Linux 8 0:5.0.0-13.el8_10, Red Hat Enterprise Linux 9 0:6.4.0-10.el9_9, Red Hat Enterprise Linux 9.8 Extended Update Support 0:6.4.0-8.el9_8
Ids: CVE-2026-108472

A flaw in the xfs_admin utility allows OS command injection and local privilege escalation.

## Steps
1. This touches infrastructure (linux). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: Red Hat Enterprise Linux 10: 0:6.16.0-2.el10_3. Red Hat Enterprise Linux 10.2 Extended Update Support: 0:6.16.0-2.el10_2. Red Hat Enterprise Linux 8: 0:5.0.0-13.el8_10. Red Hat Enterprise Linux 9: 0:6.4.0-10.el9_9. Red Hat Enterprise Linux 9.8 Extended Update Support: 0:6.4.0-8.el9_8.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | fixed | 0:6.16.0-2.el10_3 | — |
| Red Hat Enterprise Linux 10.2 Extended Update Support | fixed | 0:6.16.0-2.el10_2 | — |
| Red Hat Enterprise Linux 8 | fixed | 0:5.0.0-13.el8_10 | — |
| Red Hat Enterprise Linux 9 | fixed | 0:6.4.0-10.el9_9 | — |
| Red Hat Enterprise Linux 9.8 Extended Update Support | fixed | 0:6.4.0-8.el9_8 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-108472") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://seclists.org/oss-sec/2026/q4/676
https://pwned.coffee/i/xfs-admin-os-command-injection-cve-2026-108472

Timeline

12 Nov 2026, 23:18 UTC
Fix status: unknown → patched.
11 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Red Hat Enterprise Linux 10 before 0:6.16.0-2.el10_3 0:6.16.0-2.el10_3 CVE record (CNA) checked 12 Nov
Red Hat Enterprise Linux 10.2 Extended Update Support before 0:6.16.0-2.el10_2 0:6.16.0-2.el10_2 CVE record (CNA) checked 12 Nov
Red Hat Enterprise Linux 8 before 0:5.0.0-13.el8_10 0:5.0.0-13.el8_10 CVE record (CNA) checked 12 Nov
Red Hat Enterprise Linux 9 before 0:6.4.0-10.el9_9 0:6.4.0-10.el9_9 CVE record (CNA) checked 12 Nov
Red Hat Enterprise Linux 9.8 Extended Update Support before 0:6.4.0-8.el9_8 0:6.4.0-8.el9_8 CVE record (CNA) checked 12 Nov
Score: CVSS 7.8 (high). CVSS 3.1 7.8 (CNA redhat) for CVE-2026-108472
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Fixed in	Source
Red Hat Enterprise Linux 10	before 0:6.16.0-2.el10_3	0:6.16.0-2.el10_3	CVE record (CNA) checked 12 Nov
Red Hat Enterprise Linux 10.2 Extended Update Support	before 0:6.16.0-2.el10_2	0:6.16.0-2.el10_2	CVE record (CNA) checked 12 Nov
Red Hat Enterprise Linux 8	before 0:5.0.0-13.el8_10	0:5.0.0-13.el8_10	CVE record (CNA) checked 12 Nov
Red Hat Enterprise Linux 9	before 0:6.4.0-10.el9_9	0:6.4.0-10.el9_9	CVE record (CNA) checked 12 Nov
Red Hat Enterprise Linux 9.8 Extended Update Support	before 0:6.4.0-8.el9_8	0:6.4.0-8.el9_8	CVE record (CNA) checked 12 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

seclists.org: CVE-2026-108472 - xfs_admin allows for OS command injection

Follow on X

Totalone hot coffee