A new Linux vulnerability dubbed RefluXFS Linux vulnerability has exposed a severe local privilege escalation flaw in the XFS filesystem. Tracked as CVE-2026-64600, the bug lets an unprivileged local user silently overwrite protected system files and gain root access, even on systems running SELinux in Enforcing mode.

Qualys Threat Research Unit says the flaw has existed since kernel 4.11 and can be weaponized through a race condition in XFS copy-on-write handling.

Key Details

RefluXFS affects the XFS reflink copy-on-write path, where two concurrent O_DIRECT writes to the same reflinked file can trigger a timing bug. Under normal operation, XFS allocates a new private block before remapping the file, but the kernel briefly drops its inode lock while waiting for transaction log space.

That creates a race window.

If a second writer slips in during that window, it can remap the file and drop the reference count before the first writer resumes. The first writer then writes directly to the original block using a stale reference, and because O_DIRECT bypasses the page cache and skips revalidation, the corrupted write lands permanently on disk.

Qualys demonstrated the issue on a default RHEL 10.2 deployment, where the exploit silently removed the root account’s password protection and granted immediate passwordless root access.

Technical Analysis

The flaw is dangerous because it operates below the reach of many common hardening controls. It does not depend on kernel memory corruption in the usual sense; instead, it abuses filesystem behavior to write attacker-controlled data into protected disk blocks.

That means:

• KASLR, SMEP, and SMAP do not address this attack surface.
• SELinux does not block the vulnerable code path in testing.
• Kernel lockdown does not prevent the relevant O_DIRECT or FICLONE operations.
• Container isolation and user-namespace limits do not reliably stop it.

The exploit is particularly powerful because it survives reboots and leaves no kernel log artifacts. That makes it much harder to detect than many traditional local privilege escalation bugs.

Impact and Risks

Qualys estimates the flaw could affect more than 16.4 million systems worldwide, based on asset analysis. Affected distributions include RHEL, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux, Amazon Linux, and Fedora Server when XFS reflink is enabled.

The attack conditions are straightforward but serious:

• Kernel version 4.11 or later without the patch.
• XFS filesystem with reflink=1.
• A writable directory available to an unprivileged user.
• A high-value target such as a SUID-root binary or root account file.

The real risk is not just root escalation. It is stealth. A local user can alter a protected file without obvious signs, then keep elevated access after reboot.

Expert Recommendations

The safest response is immediate patching. Qualys and vendors have already provided fixed kernels, and there is no reliable temporary workaround that neutralizes the flaw.

Recommended actions:

• Apply the latest distribution kernel update immediately.
• Reboot systems after patching to ensure the fix is active.
• Prioritize internet-facing and multi-tenant systems.
• Confirm whether XFS reflink is enabled on critical servers.
• Review any systems with writable local directories exposed to non-privileged users.
• Treat SELinux alone as insufficient protection for this issue.
• Validate fixed kernel versions across all enterprise Linux variants.

Administrators should also assume that custom kernels, cloned images, and older fleet systems may remain vulnerable if they have not been fully rebuilt or rebooted.

Research Context

RefluXFS emerged from a joint research effort between Qualys and Anthropic, which integrated the Claude Mythos Preview model into a manual audit workflow under Project Glasswing. The model was tasked with identifying Dirty COW-style race conditions and helped surface the XFS flaw.

That is an important sign of where vulnerability research is headed. AI can accelerate pattern discovery, but human validation still matters before a report becomes a reliable exploit disclosure.

This finding also fits a broader 2026 trend of filesystem and kernel privilege-escalation research. Recent issues such as Copy Fail, Dirty Frag, DirtyClone, and now RefluXFS show a clear pattern: attackers and researchers are increasingly focusing on ways to make the kernel write attacker-influenced data into trusted memory or disk blocks.

Conclusion

RefluXFS is a serious reminder that filesystem bugs can be just as dangerous as classic memory-safety flaws. Because CVE-2026-64600 can turn a local user into root with no logs and no reboot relief, patching should be treated as urgent.

FAQ SECTION

What is RefluXFS?

RefluXFS is a race condition in the Linux XFS filesystem that can let a local user gain root privileges by corrupting protected disk blocks.

Which CVE tracks this issue?

The vulnerability is tracked as CVE-2026-64600.

Does SELinux stop the attack?

No. Testing showed the flaw can be exploited even with SELinux in Enforcing mode.

Which systems are affected?

Systems using XFS with reflink enabled and an unpatched kernel version 4.11 or later are at risk, especially major enterprise Linux distributions.

Is there a workaround?

No reliable temporary workaround is known. Patching and rebooting are the required remediation steps.