New RefluXFS Linux flaw lets attackers gain root privileges
A nine-year-old race condition vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges.
Intelligence analysis by Llama
A new Linux flaw, dubbed RefluXFS, allows attackers to gain root privileges by exploiting a race condition in the XFS filesystem. This vulnerability affects systems with an XFS filesystem with reflink enabled, running Linux kernel v4.11 or later, and a directory writable by an unprivileged local user.
Imagine you have a special file that only the computer's administrator can change. But, a clever hacker can trick the computer into changing that file for them, even though they're not the administrator. This is like a magic trick that lets the hacker do something they shouldn't be able to do.
Analysis
A Critical Flaw in the Linux Kernel's XFS Filesystem
A recent discovery by the Qualys Threat Research Unit (TRU) has revealed a critical flaw in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600. This vulnerability, dubbed RefluXFS, allows local attackers to overwrite protected files and gain root privileges.
The flaw exists in the XFS filesystem's reflink feature, which is enabled by default on major enterprise Linux distributions. The vulnerability affects systems running Linux kernel v4.11 or later, with a directory writable by an unprivileged local user, and a high-value target (a root-owned configuration file or SUID-root binary).
According to Qualys, exploitation is highly reliable, leaves no kernel log output, and the on-disk modification survives a system reboot. The Qualys TRU team explains in a detailed technical write-up that the attacker reflink-clones a target file into a scratch file they own, then races concurrent O_DIRECT writes on that scratch file. A lock-drop window in the kernel's copy-on-write allocation path lets one of those writes land, not in the attacker's own storage, but in the physical block that still backs the original file.
The change is made directly on disk, persists across reboot, produces no kernel log output, and does not touch the target file's inode -- so a modified SUID-root binary keeps its SUID bit. RefluXFS has existed since kernel version 4.11, after being introduced in February 2017 by commit 3c68d44a2b49. It has been present in every mainline and stable kernel since and was patched on July 16 after commit 2f4acd0 was merged into the Linux kernel source tree.
The list of impacted Linux distros includes Red Hat Enterprise Linux (RHEL), Oracle Linux, Amazon Linux and Fedora, as well as CentOS Stream, Rocky Linux, AlmaLinux and CloudLinux. Qualys estimates that it potentially affects more than 16.4 million systems based on analysis using its Cybersecurity Asset Management software.
Saeed Abbasi, the head of Qualys' Threat Research Unit, says the discovery emerged from a research initiative between Qualys and Anthropic, in which researchers integrated the AI model Claude Mythos Preview into their manual audit workflow. The Claude Mythos Preview was tasked with hunting for a race condition resembling the "Dirty COW" vulnerability class, and after iterative refinement identified the flaw in XFS and generated a functional proof-of-concept.
Abbasi added that the Qualys security researchers then reviewed the model's reasoning, reproduced the exploit, and independently verified all technical claims before coordinating disclosure with kernel maintainers. "Immediate kernel patching is recommended to neutralize this vulnerability. Exploitation succeeds consistently under standard hardening settings, and the on-disk modification survives a system reboot," said Abbasi.
"Vendor-fixed kernels are now available and being backported to enterprise distributions. Organizations should prioritize patching exposed and multi-tenant systems and ensure a reboot to verify the update. As of now, there are no reliable or practical mitigations or temporary configuration changes available," he added.
RefluxFS is the latest in a long series of Linux privilege escalation vulnerabilities disclosed since the start of the year, including CIFSwitch, PinTheft, Copy Fail, Dirty Frag, Fragnesia, Pack2TheRoot, and DirtyDecrypt/DirtyCBC.
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen. The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper
Key points
- A nine-year-old race condition vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges.
- The flaw affects systems with an XFS filesystem with reflink enabled, running Linux kernel v4.11 or later, and a directory writable by an unprivileged local user.
- Qualys estimates that it potentially affects more than 16.4 million systems based on analysis using its Cybersecurity Asset Management software.
- The Qualys security researchers reviewed the model's reasoning, reproduced the exploit, and independently verified all technical claims before coordinating disclosure with kernel maintainers.
- Immediate kernel patching is recommended to neutralize this vulnerability.
The discovery of this flaw has led to the development of a patch, which has been made available to affected systems. This patch should help to prevent the exploitation of this vulnerability and prevent attackers from gaining root privileges.
The fact that this flaw has existed for nine years and has been present in every mainline and stable kernel since kernel version 4.11 is concerning. It highlights the importance of regular security audits and the need for organizations to prioritize patching and updating their systems to prevent exploitation of this vulnerability.
