Description
xfsdq in xfsdump does not create quota information files securely, which allows local users to gain root privileges.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xfsdump | 2.2.8-1 | — |
| Debian 13 | xfsdump | 2.2.8-1 | — |
| Debian 12 | xfsdump | 2.2.8-1 | — |
| Debian 3.0 | xfsdump | 2.0.1-2 | DSA-283 |
Advisories 1
- DSA-283 xfsdump - insecure file creation Debian Security (DSA / DLA) · Mar 9, 2026
References
- VU#111673 third-party-advisory
- MDKSA-2003:047 vendor-advisory
- DSA-283 vendor-advisory