A newly disclosed Linux kernel vulnerability known as RefluXFS has raised concerns after researchers confirmed it can allow an unprivileged local user to gain persistent root access on affected systems. The flaw, tracked as CVE 2026 64600 and publicly disclosed on July 22, affects Linux systems using the XFS filesystem with reflink enabled under specific conditions. Security researchers at Qualys said default installations of Red Hat Enterprise Linux and several of its derivatives, along with Fedora Server and Amazon Linux, may meet the requirements for successful exploitation. Linux developers have already merged a fix into the kernel, and major Linux vendors have started distributing updated kernels with the necessary patches.
According to Qualys, the vulnerability allows an attacker to overwrite files owned by the root user on affected XFS filesystems, resulting in persistent administrative access. Researchers demonstrated successful attacks against critical files such as /etc/passwd and setuid root binaries. Because the overwrite occurs at the block layer rather than through normal file operations, the modified files retain their original ownership, permissions, timestamps, and setuid attributes, allowing altered privileged binaries to continue executing with root privileges even after the system is rebooted. The vulnerability has been traced back to Linux kernel version 4.11, released in 2017, making it a long standing flaw that remained undiscovered for nearly nine years. Successful exploitation requires three conditions: the system must be running Linux 4.11 or later without the available fix, the XFS filesystem must have been created with reflink enabled, and both the protected target file and an attacker writable directory must exist on the same XFS filesystem. Qualys recommended prioritizing patches for systems where untrusted users or workloads can execute locally, including shell environments, continuous integration servers, and compromised services.
The advisory states that default installations of Red Hat Enterprise Linux, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux versions 8 through 10, Fedora Server version 31 and later, Amazon Linux 2023, and Amazon Linux 2 images released after December 2022 may be vulnerable. Red Hat Enterprise Linux 7 is not affected because it predates XFS reflink support. Debian, Ubuntu, SUSE Linux Enterprise Server, and openSUSE generally do not use XFS as the default root filesystem, although systems manually configured with XFS and reflink enabled could also be exposed. Researchers explained that the issue results from a race condition involving stale block mappings during copy on write operations. An attacker clones a root owned file using the FICLONE operation and exploits concurrent direct input output writes during a lock transition, allowing data intended for the cloned file to overwrite protected files instead. The upstream kernel patch resolves the issue by validating block mappings after the inode lock is reacquired, preventing stale references from being used during write operations. Qualys also noted that direct input output bypasses the page cache, leaving no metadata changes or kernel warnings, making the attack difficult to detect through conventional logging.
Qualys revealed that an artificial intelligence model helped identify the vulnerability during its research. According to the company, researchers used Anthropic’s Claude Mythos Preview model to search the Linux kernel for vulnerabilities similar to Dirty COW. The model reportedly identified the race condition, generated a working privilege escalation exploit, and assisted in drafting the technical advisory before researchers independently validated the findings and coordinated responsible disclosure with Linux maintainers. Red Hat began releasing security advisories for affected kernel versions several days before public disclosure, while Debian has also started integrating fixes into supported kernel releases. Security researchers noted that there are currently no practical mitigation measures, mount options, or system configuration changes capable of disabling XFS reflinks after a filesystem has been created. Qualys also stated that technologies including SELinux in enforcing mode, seccomp, kernel lockdown, and container isolation did not prevent successful exploitation during testing. Although no confirmed exploitation in the wild had been reported at the time of disclosure, organizations are advised to install the latest vendor supplied kernel updates, reboot affected systems to load the patched kernel, and verify that the updated version is actively running to eliminate exposure.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.