FHN 
A newly discovered Linux vulnerability, called RefluXFS (CVE-2026-64600), could allow a local user to gain root access by exploiting a flaw in the Linux kernel’s XFS filesystem. Security researchers at Qualys Threat Research Unit (TRU) discovered the issue and warned that it can be exploited even when SELinux is running in Enforcing mode.
The vulnerability affects the copy-on-write (CoW) feature of XFS. It is caused by a race condition that occurs when two O_DIRECT write operations access the same reflink-enabled file at nearly the same time.
How the Vulnerability Works
Normally, when a shared file is modified, XFS creates a new private copy of the data before writing changes. However, during this process, the kernel briefly releases an internal lock while waiting for transaction log space.
If another write request arrives during this short window, it can change the file mapping before the first operation finishes. As a result, the first write uses outdated information and writes data directly to the original disk block instead of a new one.
Since O_DIRECT bypasses the page cache, the corrupted data is written straight to disk, allowing attackers to overwrite protected system files.
Why It Is Dangerous
Qualys demonstrated that a normal local user could exploit the flaw on a default RHEL 10.2 system and remove the root account’s password protection within seconds. After the attack, the system granted passwordless root access.
The attack is difficult to detect because:
- No kernel log entries are generated.
- The changes remain after a reboot.
- Even systems protected by SELinux are vulnerable.
- Existing Linux security protections do not block the attack.
Researchers believe the vulnerability has existed since Linux kernel version 4.11, released in 2017, potentially affecting more than 16 million systems worldwide.
Who Is Affected?
A system is vulnerable if it has:
- Linux kernel 4.11 or later without the security patch.
- An XFS filesystem with reflink=1 enabled.
- A directory writable by an unprivileged user.
- A valuable target file such as a SUID binary or protected system file.
Confirmed affected distributions include:
- RHEL 8, 9 and 10
- CentOS Stream 8, 9 and 10
- Oracle Linux 8, 9 and 10
- Rocky Linux 8, 9 and 10
- AlmaLinux 8, 9 and 10
- CloudLinux 8, 9 and 10
- Amazon Linux 2 and Amazon Linux 2023
- Fedora Server 31 and later
Lower-risk distributions
- Debian
- Ubuntu
- SUSE
These distributions are mainly affected only if XFS with reflink support has been manually configured.
Existing Security Features Cannot Stop It
One of the biggest concerns is that common Linux security protections do not prevent this attack. Technologies such as SELinux, KASLR, SMEP, SMAP, kernel lockdown, and container isolation operate at different layers and cannot stop exploitation of this filesystem flaw.
At present, there is no temporary workaround that completely mitigates the vulnerability. Installing the security update is the only effective solution.
AI Helped Discover the Flaw
The vulnerability was identified through a collaboration between Qualys and Anthropic. Researchers used Anthropic’s Claude Mythos Preview AI model to search for race-condition vulnerabilities similar to the well-known Dirty COW bug.
After identifying the issue, Qualys engineers independently verified the findings, created a proof-of-concept, and responsibly disclosed the vulnerability to Linux maintainers.
Part of a Growing Trend
RefluXFS is one of several major Linux privilege escalation vulnerabilities disclosed during 2026. Other recent discoveries include:
- Copy Fail (CVE-2026-31431)
- Dirty Frag (CVE-2026-43284 and CVE-2026-43500)
- DirtyClone (CVE-2026-43503)
These vulnerabilities highlight a growing trend of attackers exploiting flaws that allow protected files or memory to be modified, ultimately leading to privilege escalation.
What Organizations Should Do
Organizations should patch affected systems as soon as possible, especially internet-facing servers, multi-tenant environments, and shared systems.
Security updates are already available for major enterprise Linux distributions, including RHEL, Oracle Linux, AlmaLinux, Rocky Linux, and Fedora. After installing the update, administrators should perform a full system reboot to ensure the patched kernel is running.
Since there is currently no reliable mitigation other than patching, keeping systems updated is the best defense against the RefluXFS vulnerability.
About the Author
