Amazon Linux 2023 Security Advisory: ALAS2023-2026-3453
Advisory Released Date: 2026-11-12
Advisory Updated Date: 2026-11-12
Severity:
Important
Issue Overview:
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed. (CVE-2026-108472)
Affected Packages:
xfsprogs
Issue Correction:
Run dnf update xfsprogs --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3453 --releasever 2023.12.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
xfsprogs-xfs_scrub-debuginfo-6.12.0-3.amzn2023.0.3.aarch64
xfsprogs-6.12.0-3.amzn2023.0.3.aarch64
xfsprogs-xfs_scrub-6.12.0-3.amzn2023.0.3.aarch64
xfsprogs-devel-6.12.0-3.amzn2023.0.3.aarch64
xfsprogs-debuginfo-6.12.0-3.amzn2023.0.3.aarch64
xfsprogs-debugsource-6.12.0-3.amzn2023.0.3.aarch64
src:
xfsprogs-6.12.0-3.amzn2023.0.3.src
x86_64:
xfsprogs-debuginfo-6.12.0-3.amzn2023.0.3.x86_64
xfsprogs-xfs_scrub-debuginfo-6.12.0-3.amzn2023.0.3.x86_64
xfsprogs-xfs_scrub-6.12.0-3.amzn2023.0.3.x86_64
xfsprogs-devel-6.12.0-3.amzn2023.0.3.x86_64
xfsprogs-6.12.0-3.amzn2023.0.3.x86_64
xfsprogs-debugsource-6.12.0-3.amzn2023.0.3.x86_64