Security researchers have disclosed a nine-year-old Linux kernel vulnerability that can allow local attackers to overwrite protected files and gain root privileges.
The flaw, tracked as CVE-2026-64600 and named RefluXFS, affects the XFS filesystem when reflink support is enabled. Qualys Threat Research Unit discovered and reported the issue.
The RefluXFS Linux flaw has existed in Linux kernel versions 4.11 and later. Kernel maintainers fixed it on July 16, and vendors are now backporting the update to affected enterprise Linux distributions.
RefluXFS Targets XFS Reflink Systems
RefluXFS affects Linux systems that use an XFS filesystem with reflink enabled. Reflink support is a default configuration in several major enterprise Linux distributions.
For an attack to succeed, the target system must also contain a directory that an unprivileged local user can write to. The attacker must then have access to a valuable root-owned target, such as a configuration file or a SUID-root executable.
Qualys said the vulnerability stems from a race condition in XFS’s copy-on-write allocation process. Under certain conditions, an attacker can cause a write intended for a file they control to modify the physical disk block used by a protected file.
The modification does not alter the protected file’s inode. As a result, a compromised SUID-root binary can retain its elevated permissions.
Standard Linux Defences Do Not Stop the Attack
Qualys warned that common Linux hardening measures do not prevent RefluXFS exploitation.
The affected activity occurs at the filesystem allocation layer, below the level where many traditional protections operate. This means SELinux, kernel lockdown, container isolation and memory protections such as KASLR, SMEP and SMAP do not block the attack.
Researchers said the exploit is highly reliable, produces no kernel log output and survives a reboot because it modifies data directly on disk.
That combination makes the RefluXFS Linux flaw particularly serious in multi-user and multi-tenant environments, where a local user may have limited write access but should not be able to alter root-owned files.
Major Enterprise Linux Distributions Affected
The vulnerability affects several enterprise Linux distributions, including:
- Red Hat Enterprise Linux
- Oracle Linux
- Amazon Linux
- Fedora
- CentOS Stream
- Rocky Linux
- AlmaLinux
- CloudLinux
Qualys estimates that more than 16.4 million systems could be vulnerable based on its asset-management data.
However, exposure depends on the filesystem configuration. Systems need XFS with reflink support enabled, alongside the other conditions needed for local exploitation.
AI-Assisted Research Helped Find the Flaw
Qualys said it found the vulnerability during a research project involving Anthropic’s Claude Mythos Preview model.
Researchers asked the model to search for a race condition similar to the Dirty COW vulnerability class. After refinement, it identified the XFS issue and generated a functional proof of concept.
Qualys researchers then reviewed the model’s findings, reproduced the exploit and independently verified the technical details before coordinating disclosure with Linux kernel maintainers.
Patch Immediately and Reboot Systems
Linux kernel developers patched CVE-2026-64600 on July 16. Fixed kernels are becoming available through vendor updates and backports.
Qualys recommends that organisations patch affected systems immediately and reboot them after installing the update. A reboot helps ensure the device is running the updated kernel.
The researchers said there are currently no reliable temporary mitigations or configuration changes that neutralise the issue. Organisations should therefore prioritise exposed, shared and multi-tenant systems.
The RefluXFS Linux flaw joins several Linux privilege-escalation vulnerabilities disclosed this year, including CIFSwitch, PinTheft, Copy Fail, Dirty Frag, Fragnesia, Pack2TheRoot and DirtyDecrypt.
0 responses to “New RefluXFS Linux Flaw Lets Attackers Gain Root Privileges”