Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs
A new Linux kernel flaw, tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access. Default installations of Red Hat Enterprise Linux and its derivatives can meet the conditions for exploitat…
Intelligence analysis by Llama
A nine-year-old Linux kernel flaw, RefluXFS, allows local users to gain root access on default RHEL installs. The vulnerability, tracked as CVE-2026-64600, was discovered by Qualys using an AI model. The fix was merged on July 16, and Linux vendors have begun shipping backported kernels.
Imagine you have a file on your computer that you want to copy. But instead of copying the whole file, you just copy a reference to the file. This is called a reflink. The problem is that if someone else is trying to copy the file at the same time, they can overwrite the original file with a new version. This is what happened with the RefluXFS vulnerability. An attacker was able to overwrite a root-owned file on a default RHEL install by creating a reflink and then overwriting the original file. This allowed them to gain root access on the system.
Analysis
A $60B Vote of Confidence
The discovery of the RefluXFS vulnerability is a significant blow to the Linux community, as it highlights a critical flaw in the kernel that can be exploited by local users to gain root access on default RHEL installs. The vulnerability, tracked as CVE-2026-64600, was discovered by Qualys using an AI model, which is a testament to the power of machine learning in finding security vulnerabilities.
The RefluXFS vulnerability is a classic example of a check-then-use error, where the kernel reads the data-fork mapping under the inode lock and hands it to xfs_reflink_fill_cow_hole(), which cycles that lock to reserve transaction space. A second writer can complete the copy-on-write operation during that gap and remap the cloned file to a new block. When the first writer reacquires the lock, it refreshes the copy-on-write fork but continues using the old data-fork mapping. The shared-status query itself is correct; what it queries is a block address captured before the lock was released.
The RefluXFS vulnerability is not the first aged kernel bug this year. Qualys has been finding a lot of these. A day earlier, it disclosed a snap-confine flaw in Ubuntu Desktop, CVE-2026-8933, where two races let a local user get root on default installs. In May it found a nine-year-old bug in the kernel's ptrace checks.
Why Cursor?
The RefluXFS vulnerability is a reminder that even the most secure systems can have vulnerabilities. The use of an AI model to discover the vulnerability is a testament to the power of machine learning in finding security vulnerabilities. It is also a reminder that even the most secure systems can have vulnerabilities.
The Road Ahead
The discovery of the RefluXFS vulnerability is a significant blow to the Linux community, as it highlights a critical flaw in the kernel that can be exploited by local users to gain root access on default RHEL installs. The vulnerability, tracked as CVE-2026-64600, was discovered by Qualys using an AI model, which is a testament to the power of machine learning in finding security vulnerabilities. The fix was merged on July 16, and Linux vendors have begun shipping backported kernels.
Key points
- A new Linux kernel flaw, tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access.
- Default installations of Red Hat Enterprise Linux and its derivatives can meet the conditions for exploitation.
- The fix was merged on July 16, and Linux vendors have begun shipping backported kernels.
- Qualys used an AI model to discover the vulnerability, which is a testament to the power of machine learning in finding security vulnerabilities.
- The RefluXFS vulnerability is not the first aged kernel bug this year. Qualys has been finding a lot of these.
The discovery of the RefluXFS vulnerability is a significant blow to the Linux community, but it also highlights the importance of security and the need for continued vigilance. The use of an AI model to discover the vulnerability is a testament to the power of machine learning in finding security vulnerabilities. It is also a reminder that even the most secure systems can have vulnerabilities.
The RefluXFS vulnerability is a reminder that even the most secure systems can have vulnerabilities. The use of an AI model to discover the vulnerability is a testament to the power of machine learning in finding security vulnerabilities. It is also a reminder that even the most secure systems can have vulnerabilities.
