RefluXFS: New Linux Kernel Flaw (CVE-2026-64600) Exposes XFS Filesystems to Persistent Root Access

A critical Linux kernel vulnerability, dubbed "RefluXFS" and assigned CVE-2026-64600, has been publicly disclosed, revealing a severe flaw within the XFS filesystem that allows an unprivileged local user to achieve persistent root access. Disclosed on July 22, this newly identified race condition enables attackers to overwrite files owned by the root user, maintaining elevated privileges even after a system reboot. The discovery, spearheaded by security researchers at Qualys, highlights the persistent challenges in maintaining the security integrity of complex operating system kernels, particularly given the vulnerability’s decade-long existence within the codebase.

The RefluXFS vulnerability primarily targets XFS filesystems configured with reflink support, a feature designed to optimize storage by allowing multiple files to share the same physical data blocks. According to Qualys, default installations of several major Linux distributions, including Red Hat Enterprise Linux (RHEL) and its derivatives (CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux 8, 9, and 10), Fedora Server (31 and later), and Amazon Linux (2023 and 2 images from December 2022 onward), are susceptible to exploitation. This broad exposure underscores the urgency for system administrators to apply the necessary security patches.

A Deep Dive into the Stale Mapping Flaw

At its core, RefluXFS exploits a classic race condition within the XFS filesystem’s copy-on-write (CoW) mechanism, specifically impacting how reflinked files are handled during concurrent write operations. The flaw, traced back to Linux kernel version 4.11 in 2017 (via commit 3c68d44a2b49), arises from a "check-then-use" error across a lock cycle.

When a user initiates a FICLONE operation, a root-owned file is cloned into a scratch file. Both files initially reference the same physical disk blocks due to XFS’s reflink capabilities. The vulnerability manifests during a subsequent process where an attacker races concurrent O_DIRECT writes against the cloned file. O_DIRECT is a specialized I/O mode that bypasses the kernel’s page cache, writing data directly to disk blocks.

The sequence of events leading to exploitation unfolds as follows:

1. Initial Mapping: The kernel reads the data-fork mapping for the reflinked file under an inode lock (ILOCK).
2. Lock Release and Transaction Reservation: The xfs_reflink_fill_cow_hole() function (and xfs_reflink_fill_delalloc(), also affected) temporarily releases the inode lock to reserve transaction space.
3. Race Condition Trigger: During this brief window where the lock is released, a second, concurrent writer (controlled by the attacker) can complete a copy-on-write operation on the cloned file. This operation remaps the cloned file to a new set of physical disk blocks, effectively unsharing it from the original root-owned file.
4. Stale Mapping Use: When the first writer reacquires the inode lock, it attempts to refresh the copy-on-write fork. However, it continues to use the old data-fork mapping that was captured before the lock was dropped. This mapping now points exclusively to the physical disk blocks still owned by the original, protected root file.
5. Unauthorized Overwrite: Believing the block to be unshared (due to the stale mapping), XFS permits the O_DIRECT write operation. Consequently, data intended for the attacker’s controlled clone is erroneously written directly to the physical disk blocks belonging to the original, root-owned target file.

The impact of this block-layer overwrite is profound: it bypasses the target inode entirely, meaning critical metadata such as file ownership, permissions, timestamps, and the setuid bit remain unaltered. This allows a modified setuid-root binary to execute with root privileges, providing persistent access that survives system reboots. The researchers noted that their tests typically achieved a successful race in under ten seconds, demonstrating the practicality of the exploit. Furthermore, because the write bypasses standard file system layers, it leaves no kernel warning or log entry, making detection challenging.

The Role of AI in Vulnerability Discovery

A particularly noteworthy aspect of RefluXFS’s discovery is the integral role played by artificial intelligence. Qualys researchers revealed that the flaw was initially identified by "Claude Mythos Preview," Anthropic’s restricted-access frontier AI model. The research team specifically tasked the AI with finding vulnerabilities similar to the infamous "Dirty COW" (CVE-2016-5195), another Linux kernel privilege escalation flaw involving a race condition and copy-on-write mechanisms.

Dirty COW, discovered in 2016, allowed an unprivileged local user to gain write access to read-only memory mappings, thereby escalating privileges. The AI’s ability to identify RefluXFS, write a functional root exploit, and even draft a technical advisory based on a conceptual prompt for a similar vulnerability underscores the rapidly evolving landscape of cybersecurity research. After the AI’s initial findings, human researchers at Qualys reproduced the exploit on a stock Fedora Server 44 installation, verified the model’s reasoning, and coordinated the disclosure with upstream maintainers and affected vendors.

This is not an isolated incident for Qualys this year, as the company has reported several aged kernel bugs. Just prior to RefluXFS, they disclosed a snap-confine flaw in Ubuntu Desktop (CVE-2026-8933) and, in May, a nine-year-old bug in the kernel’s ptrace checks, further emphasizing the depth and complexity of modern operating system security.

Scope of Exposure and Conditions for Exploitation

Exploiting RefluXFS requires three specific conditions to be met on the target system:

1. Local User Access: An unprivileged local user must be able to execute code on the system. This could be through a shell, a Continuous Integration (CI) job, or a compromised service.
2. XFS Filesystem with Reflink Enabled: The target filesystem must be XFS and have reflink support enabled. Reflink support was introduced in Linux 4.9 and is a common feature on modern XFS installations.
3. Protected File and Attacker-Writable Directory on Same Filesystem: A protected file (e.g., a setuid-root binary like /etc/passwd or /usr/bin/sudo) and an attacker-writable directory must reside on the same XFS filesystem.

Qualys explicitly advises prioritizing patching for "exposed and multi-tenant systems," which includes any XFS host where untrusted code can run locally. This encompasses a wide array of environments, from shared hosting servers to containerized deployments and CI/CD pipelines where build jobs might execute untrusted scripts.

The advisory meticulously lists the distributions and versions that meet the conditions for exploitation:

• Red Hat Enterprise Linux, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, and CloudLinux 8, 9, and 10.
• Fedora Server 31 and later.
• Amazon Linux 2023, and Amazon Linux 2 images from December 2022 onward.

Notably, RHEL 7 filesystems are not affected, as they predate the widespread adoption and support for XFS reflink. Distributions like Debian, Ubuntu, SLES (SUSE Linux Enterprise Server), and openSUSE do not typically use XFS for their root filesystems by default. Therefore, these systems are only exposed if an administrator explicitly chose XFS with reflink enabled during the installation process for the root filesystem or any other mounted XFS volume containing sensitive files.

System administrators can quickly check if their root filesystem has reflink enabled using the command: xfs_info / | grep reflink=. If the output includes reflink=1, then condition two is met for the root filesystem. The same check should be performed on any other mounted XFS volume where protected files and attacker-writable directories might coexist.

Vendor Response and Patching Timeline

Linux vendors moved swiftly to address the RefluXFS vulnerability following its coordinated disclosure. The fix for the underlying kernel bug was merged upstream on July 16, a few days before the public announcement, allowing vendors time to prepare and distribute patches.

Red Hat, given the significant exposure of its enterprise distributions, issued "Important"-rated kernel advisories across affected RHEL 8, 9, and 10 streams. The errata began landing on July 14, even before the public disclosure. Specific advisories include RHSA-2026:39179 and RHSA-2026:39180 for RHEL 8, and RHSA-2026:39494 for RHEL 10, with extended-support and SAP streams receiving updates through July 17. Red Hat’s bug tracker initially categorized the flaw as "kernel: XFS data corruption using reflink," indicating the initial understanding of the issue before the full privilege escalation implications were detailed. Administrators are advised to confirm that an advisory exists for their precise RHEL release and to check patch dates to ascertain their system’s exposure status.

For other distributions, patching efforts are ongoing. As of July 23, Debian’s security tracker listed the fix in trixie-security as kernel 6.12.96-1 and in unstable as 7.1.4-1. However, trixie‘s base kernel 6.12.94-1 and forky‘s 7.1.3-1 were still marked vulnerable, as were older stable releases like bookworm and bullseye, including their security branches. Users of these distributions should monitor official security advisories and update their kernels as soon as patches become available.

Mitigation and Remediation Strategies

The nature of the RefluXFS vulnerability presents significant challenges for temporary mitigation. Qualys researchers explicitly stated that no practical mitigation or temporary configuration change is available to disable XFS reflinks after a filesystem has been created. Furthermore, the company’s testing confirmed that standard security mechanisms such as SELinux in Enforcing mode, seccomp filters, kernel lockdown mode, and container boundaries were all ineffective in preventing the exploit. This is primarily because the vulnerability operates at the block layer, bypassing higher-level security controls that typically govern file access or memory operations. Memory protections like KASLR (Kernel Address Space Layout Randomization) and SMEP (Supervisor Mode Execution Prevention) were also irrelevant, as the flaw involves data corruption on disk rather than memory corruption.

The only effective remediation is to apply the vendor-provided kernel update. It is crucial to understand that simply installing the package does not replace the kernel actively running in memory. Therefore, after applying the update, system administrators must reboot the system to ensure that the fixed kernel is loaded and operational. Following the reboot, it is highly recommended to verify that the system is indeed running the patched kernel version.

One apparent limitation of the exploit, that the race only fires if the target’s block starts unshared, was also debunked by Qualys. While an administrator might reflink-copy a file, making it initially immune, an unprivileged user can reset this condition, for example, by running chsh. Moreover, critical setuid-root binaries are generally unlikely to have been reflinked in the first place, thus remaining vulnerable.

At the time of writing, Qualys had not published standalone exploit code, adhering to responsible disclosure practices. However, Red Hat’s bug tracker logged a public proof-of-concept on July 22, referencing the detailed advisory posted to the oss-security mailing list, which outlines the race condition and exploitation steps in full. None of the vendors tracking the flaw had reported instances of in-the-wild exploitation.

Broader Implications for Cybersecurity

The RefluXFS vulnerability serves as a stark reminder of the enduring complexity of kernel security and the potential for long-standing, critical flaws to remain undetected for years. Existing for nearly a decade, this bug highlights that even well-vetted and widely deployed filesystems can harbor severe privilege escalation vectors.

The successful application of an AI model, Claude Mythos Preview, in discovering RefluXFS also heralds a new era in cybersecurity research. While AI has been utilized in security for some time, its capacity to proactively identify novel vulnerabilities, especially by abstracting patterns from known exploits like Dirty COW, suggests a transformative shift. This could accelerate the discovery of deeply embedded flaws, but also potentially empower malicious actors with similar capabilities.

For organizations, the incident underscores the critical importance of a robust patch management strategy, particularly for systems hosting sensitive data or running multi-tenant applications. The lack of practical mitigations further stresses that timely patching and system reboots are not merely best practices but absolute necessities for maintaining a secure posture against such persistent local privilege escalation threats.

The Hacker News has reached out to Red Hat for comment on its assessment of the flaw’s impact and to Qualys for further detail on the finding, and will update this story with any response. In the interim, all affected system administrators are strongly urged to prioritize applying the necessary kernel updates and rebooting their systems without delay to protect against RefluXFS.