RefluXFS CVE: Nine-Year-Old Linux Kernel Flaw Grants Root

A nine-year-old race condition in the Linux kernel’s XFS filesystem, tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on disk and gain persistent root access. The flaw, dubbed RefluXFS by Qualys, affects default installations of Red Hat Enterprise Linux and its derivatives. Consequently, Qualys estimates more than 16.4 million systems worldwide are potentially exposed.

What Happened: RefluXFS Linux Kernel Race Condition Grants Root on Default RHEL Installs

Qualys Threat Research Unit disclosed CVE-2026-64600 on July 22, 2026. The vulnerability lives in the XFS filesystem copy-on-write path and has been present since Linux kernel 4.11 in February 2017. Moreover, it requires no special capabilities or non-default configurations to exploit.

An attacker with an ordinary local account can reflink-clone a protected file, then race concurrent O_DIRECT writes against that clone. Furthermore, a lock-drop window in the kernel’s copy-on-write allocation path lets one write land in the physical block still backing the original file. Thus, the change is made directly on disk, persists across reboots, and produces no kernel log output.

The discovery emerged from a structured research initiative between Qualys and Anthropic. For this project, researchers integrated Claude Mythos Preview into their manual audit workflow. The model identified the race condition, wrote a working root exploit, and drafted the advisory. Qualys security researchers then reviewed the model’s reasoning, reproduced the exploit, and independently verified all technical claims before coordinating disclosure upstream.

Technical Details of the RefluXFS Vulnerability

RefluXFS is a check-then-use race condition in the Linux kernel’s XFS reflink copy-on-write path. The attacker reflink-clones a target file into a scratch file they own, then races concurrent O_DIRECT writes on that scratch file.

The kernel reads the data-fork mapping under the inode lock and hands it to xfs_reflink_fill_cow_hole(). This helper cycles the inode lock to reserve transaction log space. During that gap, a second writer can complete the copy-on-write operation and remap the cloned file to a new block. When the first writer reacquires the lock, it refreshes the copy-on-write fork but continues using the old data-fork mapping.

The stale address now points to a block owned only by the original protected file. XFS sees the block as unshared and permits the direct write. Therefore, data intended for the attacker’s clone lands in the target instead. Because O_DIRECT skips the page cache and has no revalidation hook, the write lands on disk. Since it bypasses the target inode entirely, the metadata never changes, and tests produced no kernel warning or log entry.

Who Is Exposed

Exploitation requires three conditions:

• The system runs Linux kernel 4.11 or later without the RefluXFS fix
• The XFS filesystem was created with reflink=1
• The readable target and an attacker-writable directory are on the same XFS filesystem

Qualys confirmed that default installations of the following distributions are vulnerable:

• Red Hat Enterprise Linux 8, 9, and 10
• CentOS Stream 8, 9, and 10
• Oracle Linux 8, 9, and 10
• Rocky Linux, AlmaLinux, and CloudLinux 8, 9, and 10
• Fedora Server 31 and later
• Amazon Linux 2023 and Amazon Linux 2 AMIs from December 2022 onward

Debian, Ubuntu, SLES, and openSUSE do not generally use XFS for the root filesystem by default. However, they become exposed if an administrator chose XFS with reflink enabled at install time. RHEL 7 filesystems are not affected because they predate XFS reflink support entirely.

Why Existing Mitigations Do Not Stop It

The flaw lives at the filesystem allocation layer, below or outside the reach of standard hardening defenses. Memory-protection features such as KASLR, SMEP, and SMAP do not apply to block-layer writes. Moreover, kernel lockdown places no restrictions on O_DIRECT or FICLONE for unprivileged users. SELinux in Enforcing mode and seccomp profiles both failed to stop the exploit in Qualys testing. In addition, container boundaries and user-namespace restrictions operate at layers the flaw never touches.

Business and Operational Impact

The RefluXFS vulnerability poses a severe risk to enterprise Linux deployments. Qualys estimates more than 16.4 million systems are potentially affected based on analysis using its Cybersecurity Asset Management platform.

• Root compromise from any local account: A standard user, CI job, or compromised service can escalate to host root
• Persistent backdoors: Modified SUID-root binaries keep their setuid bit, so implants survive reboots
• No detection artifacts: Exploitation produces no kernel log output, making forensic detection difficult
• Multi-tenant risk: Cloud VMs, shared hosting, and container platforms where untrusted code runs locally are especially vulnerable
• Wide distribution footprint: RHEL derivatives dominate enterprise server fleets, financial systems, and government infrastructure

Furthermore, while CVE-2026-64600 itself is strictly local, successful exploitation on a compromised host could enable attackers to establish persistence, manipulate credentials, or facilitate lateral movement within a network.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Apply the latest vendor kernel updates immediately. Vendor-fixed kernels are available and being backported to enterprise distributions
2. Reboot the system after patching to ensure the fixed kernel is running in memory
3. Prioritize exposed and multi-tenant systems, including cloud VMs and shared hosting platforms
4. Verify patch status with uname -r and confirm the running kernel carries the July 16, 2026 fix or later
5. Check root filesystem exposure with xfs_info / | grep reflink= — reflink=1 means the system is vulnerable if unpatched

Monitoring and Detection Guidance

No practical mitigation or temporary configuration change is available. Qualys stated there is no mount option or sysctl that disables XFS reflinks after a filesystem has been created. Therefore, patching and rebooting are the only reliable defenses. Organizations should monitor for anomalous local privilege escalation patterns and review system integrity of SUID-root binaries through file-integrity monitoring tools.

Bottom line: Patch your kernels now, then reboot. RefluXFS bypasses every common hardening control, leaves no logs, and grants persistent root from any local account. The patch has been available since July 16 — if you have not applied it, you are exposed.

Incident Summary

CVE ID / Incident:	CVE-2026-64600 (RefluXFS)
Affected Systems:	RHEL 8/9/10, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux, Amazon Linux, Fedora Server with XFS reflink=1
Disclosure Date:	July 22, 2026
Patch Status:	Fixed — kernel patch merged July 16, 2026; vendor backports available
Severity:	Critical — local privilege escalation to root with no kernel logs
Exploitation in the Wild:	No confirmed exploitation reported as of July 23, 2026
Mitigations:	None practical; kernel patch and reboot required

References

1. Qualys Threat Research Unit, “RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600),” July 22, 2026, https://blog.qualys.com/vulnerabilities-threat-research/2026/07/22/refluxfs-a-linux-kernel-local-privilege-escalation-to-root-in-xfs-cve-2026-64600, accessed July 23, 2026.
2. Qualys, “RefluXFS: Local Privilege Escalation via XFS reflink direct-I/O race (CVE-2026-64600),” Qualys Security Advisory, July 22, 2026, https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt, accessed July 23, 2026.
3. BleepingComputer, “New RefluXFS Linux flaw lets attackers gain root privileges,” July 23, 2026, https://www.bleepingcomputer.com/news/linux/new-refluxfs-linux-flaw-lets-attackers-gain-root-privileges/, accessed July 23, 2026.
4. The Hacker News, “Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs,” July 23, 2026, https://thehackernews.com/2026/07/nine-year-old-refluxfs-linux-flaw-gives.html, accessed July 23, 2026.
5. Red Hat, “CVE-2026-64600 — kernel: XFS data corruption using reflink,” Red Hat Bugzilla, https://bugzilla.redhat.com/show_bug.cgi?id=2498915, accessed July 23, 2026.
6. Linux Kernel, “xfs: resample the data fork mapping after cycling ILOCK,” Commit 2f4acd0, July 16, 2026, https://git.kernel.org/…/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7, accessed July 23, 2026.