● Covered by 2 sources · 2 reportsHigh impact2 negative
RefluXFS Linux Kernel Flaw Allows Local Root Access on XFS Filesystems
Key points
- RefluXFS (CVE-2026-64600) is a nine-year-old Linux kernel flaw.
- It allows local users to overwrite root-owned files on XFS filesystems.
- Exploitation grants persistent root access and survives reboots.
- Affects Linux kernel v4.11+ and XFS with `reflink=1` (often default).
- Standard security defenses do not block RefluXFS attacks.
Overview of RefluXFS Vulnerability
A race condition vulnerability in the Linux kernel's XFS filesystem, identified as CVE-2026-64600 and dubbed RefluXFS by Qualys, allows unprivileged local users to achieve persistent root access. The flaw enables attackers to overwrite root-owned files, such as `/etc/passwd` or setuid-root binaries, on XFS filesystems.
The vulnerability has existed since Linux kernel version 4.11, released in 2017, and was publicly disclosed on July 22. The fix for RefluXFS was merged on July 16, and Linux vendors have begun distributing backported kernels.
Conditions for Exploitation
Exploitation of RefluXFS requires three specific conditions to be met. First, the system must be running Linux kernel 4.11 or later without the RefluXFS patch. Second, the XFS filesystem must have been created with `reflink=1`, which is a default configuration on several major enterprise Linux distributions. Third, both a readable target file and an attacker-writable directory must reside on the same XFS filesystem.
Affected Systems and Impact
Qualys confirmed that default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux meet the conditions for exploitation. The attack operates at the filesystem allocation layer, meaning standard security defenses like SELinux, kernel lockdown, container isolation, and memory-protection features do not prevent RefluXFS attacks.
Exploitation is highly reliable, leaves no kernel log output, and the modifications made to the disk persist even after a system reboot. The ownership, permissions, timestamps, and setuid bit of the modified files remain untouched, allowing a modified setuid-root binary to continue running as root.
Mitigation and Recommendations
Qualys recommends that organizations prioritize patching exposed and multi-tenant systems immediately. The fix for the vulnerability has been integrated into the Linux kernel, and distributions are now releasing updated kernels to address the issue.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
A nine-year-old race condition vulnerability, dubbed RefluXFS (CVE-2026-64600), in the Linux kernel's XFS filesystem allows local attackers to overwrite protected files and gain root privileges. This flaw affects major enterprise Linux distributions and bypasses standard security defenses, posing a significant risk to affected systems.
A nine-year-old Linux kernel flaw, RefluXFS (CVE-2026-64600), allows unprivileged local users to overwrite root-owned files on XFS filesystems and gain persistent root access. This vulnerability affects default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux, requiring immediate patching for exposed systems.