New Linux Kernel Vulnerability "RefluXFS" Grants Root Access via XFS Race Condition
A critical Linux kernel vulnerability, CVE-2026-64600 (dubbed RefluXFS), has been disclosed by Qualys Threat Research Unit (TRU), allowing unprivileged local users to overwrite protected system files and escalate to root privileges even on systems with SELinux in Enforcing mode. The flaw stems from a race condition in the XFS filesystem’s copy-on-write (CoW) path, triggered when two concurrent O_DIRECT writes target the same reflinked file.
How the Exploit Works
XFS normally handles reflinked file writes by allocating new blocks, but the kernel briefly drops its inode lock while waiting for transaction log space. During this window, a second write operation can remap the file and drop the reference count, causing the first write to corrupt the original block using a stale reference. Since O_DIRECT bypasses the page cache, the malicious write persists on disk without leaving kernel logs, making detection nearly impossible.
Qualys demonstrated a proof-of-concept on a default RHEL 10.2 deployment, silently removing the root account’s password protection in seconds, granting passwordless root access that survives reboots.
Scope & Impact
- Affected Systems: Linux kernels 4.11+ (since 2017), including RHEL 8/9/10, CentOS Stream, Oracle Linux, Rocky/AlmaLinux, Amazon Linux 2023, and Fedora 31+.
- Lower-Risk Distros: Debian, Ubuntu, and SUSE are only vulnerable if XFS is manually configured with
reflink=1. - Conditions for Exploitation:
- Kernel 4.11+ without the patch.
- XFS filesystem with
reflink=1enabled. - A writable directory for an unprivileged user and a high-value target (e.g., SUID-root binary).
- Estimated Impact: Over 16.4 million systems worldwide, per Qualys’ analysis.
Security Bypass & No Workarounds
The flaw operates below conventional kernel hardening mechanisms, evading protections like:
- KASLR, SMEP, SMAP (memory protections).
- Kernel lockdown (no restriction on O_DIRECT/FICLONE).
- SELinux (does not block the vulnerable code path).
- Container isolation (user-namespace restrictions and capability limits fail to mitigate).
No reliable workaround exists patching is the only solution.
AI-Assisted Discovery & Broader Trend
The vulnerability was identified through a joint research initiative between Qualys and Anthropic, using Claude Mythos Preview to hunt for Dirty COW-style race conditions. After iterative prompting, the AI model pinpointed the XFS flaw and generated a working PoC, later verified by Qualys engineers.
This follows a 2026 trend of high-impact Linux privilege-escalation bugs, including:
- CVE-2026-46333 (nine-year-old ptrace flaw).
- CrackArmor (AppArmor-based root-access chain, affecting 12M+ systems).
- DirtyClone, DirtyFrag, and Copy Fail (page-cache corruption bugs).
Vendor Response & Patching
Fixed kernels are already available for RHEL, Oracle Linux, AlmaLinux, Rocky Linux, and Fedora, with backports in progress. Organizations are advised to apply updates and reboot affected systems, particularly internet-facing and multi-tenant environments, as no interim mitigation exists.
Source: https://cybersecuritynews.com/refluxfs-linux-kernel-vulnerability/
Oracle TPRM report: https://www.rankiteo.com/company/oracle-linux
AlmaLinux TPRM report: https://www.rankiteo.com/company/tuxcare
CentOS TPRM report: https://www.rankiteo.com/company/tuxcare
Rocky Linux TPRM report: https://www.rankiteo.com/company/rockylinux
Amazon TPRM report: https://www.rankiteo.com/company/amazonscience
"id": "amaoratuxroc1784752018",
"linkid": "amazonscience, oracle-linux, tuxcare, rockylinux",
"type": "Vulnerability",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Technology/Software',
'name': 'Red Hat (RHEL 8/9/10, CentOS Stream)',
'type': 'Operating System Vendor'},
{'industry': 'Technology/Software',
'name': 'Oracle Linux',
'type': 'Operating System Vendor'},
{'industry': 'Technology/Software',
'name': 'Rocky Linux',
'type': 'Operating System Vendor'},
{'industry': 'Technology/Software',
'name': 'AlmaLinux',
'type': 'Operating System Vendor'},
{'industry': 'Technology/Cloud',
'name': 'Amazon Linux 2023',
'type': 'Operating System Vendor'},
{'industry': 'Technology/Software',
'name': 'Fedora 31+',
'type': 'Operating System Vendor'},
{'industry': 'Technology/Software',
'name': 'Debian (if XFS manually configured with '
'reflink=1)',
'type': 'Operating System Vendor'},
{'industry': 'Technology/Software',
'name': 'Ubuntu (if XFS manually configured with '
'reflink=1)',
'type': 'Operating System Vendor'},
{'industry': 'Technology/Software',
'name': 'SUSE (if XFS manually configured with '
'reflink=1)',
'type': 'Operating System Vendor'}],
'attack_vector': 'Local',
'data_breach': {'sensitivity_of_data': 'Potential access to sensitive system '
'data (e.g., passwords, configuration '
'files)'},
'description': 'A critical Linux kernel vulnerability (CVE-2026-64600, dubbed '
'RefluXFS) allows unprivileged local users to overwrite '
'protected system files and escalate to root privileges, even '
'on systems with SELinux in Enforcing mode. The flaw stems '
'from a race condition in the XFS filesystem’s copy-on-write '
'(CoW) path, triggered when two concurrent O_DIRECT writes '
'target the same reflinked file.',
'impact': {'identity_theft_risk': 'High (potential for unauthorized access to '
'sensitive data)',
'operational_impact': 'Potential unauthorized root access, system '
'compromise, and persistence of malicious '
'changes',
'systems_affected': 'Over 16.4 million systems worldwide'},
'initial_access_broker': {'high_value_targets': 'SUID-root binaries, critical '
'system files'},
'investigation_status': 'Vulnerability disclosed, patches available',
'lessons_learned': 'The vulnerability highlights the risks of race conditions '
'in filesystem operations and the need for rigorous kernel '
'hardening. AI-assisted vulnerability discovery can '
'accelerate identification of critical flaws.',
'post_incident_analysis': {'corrective_actions': 'Kernel patches to address '
'the race condition and '
'prevent unauthorized file '
'overwrites.',
'root_causes': 'Race condition in XFS filesystem’s '
'copy-on-write (CoW) path due to '
'improper inode lock handling '
'during O_DIRECT writes.'},
'recommendations': ['Apply kernel updates immediately and reboot affected '
'systems.',
'Monitor for unauthorized root access or modifications to '
'critical system files.',
'Review XFS filesystem configurations to ensure reflink '
'is disabled if not required.',
'Implement enhanced logging and monitoring for O_DIRECT '
'write operations.'],
'references': [{'source': 'Qualys Threat Research Unit (TRU)'},
{'source': 'Anthropic (Claude Mythos Preview)'}],
'response': {'containment_measures': 'Patching and rebooting affected systems',
'remediation_measures': 'Apply kernel updates from vendors '
'(RHEL, Oracle Linux, AlmaLinux, Rocky '
'Linux, Fedora)',
'third_party_assistance': 'Qualys Threat Research Unit (TRU)'},
'title': "New Linux Kernel Vulnerability 'RefluXFS' Grants Root Access via "
'XFS Race Condition',
'type': 'Privilege Escalation',
'vulnerability_exploited': 'Race condition in XFS filesystem’s copy-on-write '
'(CoW) path (CVE-2026-64600)'}