A critical vulnerability, identified as CVE-2026-64600 and dubbed “RefluXFS,” has been discovered in the Linux kernel’s XFS filesystem. This flaw allows unprivileged local users to overwrite protected system files, potentially granting them root access. The issue affects systems running Linux kernel versions 4.11 and later, including default installations of Red Hat Enterprise Linux (RHEL), Fedora Server, and Amazon Linux.
The vulnerability arises from a race condition in the XFS filesystem’s copy-on-write mechanism. When two concurrent O_DIRECT writes target the same reflinked file, a timing flaw can be exploited. XFS typically handles writes to shared blocks by allocating a new private block and remapping the file. However, during this process, the kernel temporarily releases its inode lock while waiting for transaction log space, creating a window for a second writer to intervene. This intervention can lead to the first writer inadvertently writing directly to the original block using outdated references, resulting in unauthorized modifications to protected files.
Exploitation of this flaw is highly reliable and leaves no traces in kernel logs, making detection challenging. The issue has been present since the release of Linux kernel version 4.11 in 2017, potentially impacting over 16.4 million systems worldwide. Systems are vulnerable if they meet the following conditions:
- Running an unpatched Linux kernel version 4.11 or later.
- Utilizing an XFS filesystem with reflink enabled.
- Having a directory writable by an unprivileged user alongside a high-value target, such as a SUID-root binary.
Qualys, the security firm that identified the vulnerability, demonstrated its exploitability on a default RHEL 10.2 deployment. In their proof-of-concept, they were able to strip the root account’s password protection within seconds, granting immediate, passwordless root access. The modification persists through system reboots and does not generate kernel log artifacts, complicating detection efforts.
To mitigate the risk posed by RefluXFS, it is imperative for organizations to apply the necessary kernel patches promptly. Vendor-fixed kernels have been released and are being backported to enterprise distributions. Prioritizing the patching of exposed and multi-tenant systems is crucial, especially for any reflink-enabled XFS host where untrusted code can run locally. As of now, there are no reliable or practical mitigations or temporary configuration changes available, making immediate kernel patching the recommended course of action.
This vulnerability underscores the importance of regular system updates and vigilant monitoring of security advisories. Organizations should assess their systems for the specified conditions and apply patches without delay to prevent potential exploitation. The discovery of RefluXFS highlights the need for continuous security assessments and the prompt application of patches to maintain system integrity and security.
