A newly disclosed CVE-2026-64600, dubbed “RefluXFS,” a critical race condition in the Linux kernel’s XFS filesystem that allows unprivileged local users to escalate to full root privileges.
The flaw affects any Linux distribution shipping an XFS root filesystem with reflink enabled, including default installations of RHEL, Oracle Linux, Amazon Linux, and Fedora. Qualys estimates over 16.4 million systems worldwide are potentially exposed.
RefluXFS lives in XFS’s copy-on-write (CoW) path and triggers when two concurrent O_DIRECT writes target the same reflinked file.
Critical XFS Race Condition
XFS handles writes to shared blocks by allocating a new private block, remapping the file, and decrementing the original block’s reference count. To avoid deadlocks, the kernel drops its inode lock while waiting for transaction log space.
During this window, a second writer can complete its own CoW cycle, remapping the file and dropping the original block’s reference count to one. When the first writer re-acquires the lock, it re-checks the reference count using a stale physical block address captured before the lock was dropped.
Seeing a count of one, it wrongly assumes the block is private and writes directly to the original file’s physical block. Because O_DIRECT bypasses the page cache and skips revalidation, the write persists to disk, silently overwriting the target file.
An attacker with an ordinary local account can exploit this to overwrite any readable file on an XFS volume, including /etc/passwd or SUID-root binaries.
Qualys demonstrated the exploit on a default RHEL 10.2 deployment, escalating from an unprivileged shell to passwordless root within seconds. Critically, the modification survives reboots and generates no kernel log output, making detection via traditional monitoring extremely difficult.
The bug has existed since kernel 4.11 (2017) and works even under SELinux Enforcing mode, since the affected code path isn’t restricted by SELinux policy in testing.
RefluXFS bypasses conventional hardening because it operates at the filesystem allocation layer, below where most protections operate. KASLR, SMEP, and SMAP target memory-corruption attacks, not block-layer writes. Kernel lockdown doesn’t restrict O_DIRECT or FICLONE for unprivileged users.
Seccomp profiles that permit \write\ and \ioctl\ (standard for most workloads) provide no barrier. Container isolation, user namespaces, and hardened allocators likewise don’t touch this layer.
Affected Systems
Exposure requires three conditions: kernel v4.11+ without the patch, an XFS filesystem with \reflink=1, and a directory writable by an unprivileged user coexisting with a high-value root-owned target.
Confirmed affected distributions include RHEL, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux (versions 8–10), Amazon Linux 2023/2, and Fedora Server 31+. Debian, Ubuntu, and SUSE aren’t affected by default but become vulnerable if XFS with reflink is manually configured.
Mitigation
Qualys confirms there are no viable temporary mitigations; patching and rebooting is the only fix. Vendor-fixed kernels are already available and being backported across enterprise distributions.
Organizations should prioritize multi-tenant and internet-facing systems, apply updates immediately, and verify remediation with a full reboot since changes persist across restarts.
Notably, the vulnerability was discovered through a collaborative research effort between Qualys and Anthropic, using Claude Mythos Preview to accelerate manual kernel auditing with all findings independently verified by human researchers before disclosure.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
