RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600)

Summary

Qualys TRU has identified CVE-2026-64600, a race condition in the Linux kernel's XFS filesystem copy-on-write path. This vulnerability allows an attacker with local privileges to overwrite protected files and gain root access, even with SELinux enforcing. The flaw has existed since kernel version 4.11 and potentially affects over 16.4 million systems.

Full text

Table of ContentsExecutive summaryDiscovery process and research methodologyUnderstanding the Potential Impact of the RefluXFS VulnerabilityWatch a RefluXFS Proof-of-concept DemonstrationAffected Systems & PrerequisitesHow does RefluXFS work?Why Existing Mitigations Dont Stop ItTechnical Details of the RefluXFS vulnerability:AcknowledgmentsQualys QID Coverage for Detecting theRefluXFS vulnerability (CVE-2026-64600):Conclusion Executive summary Qualys Threat Research Unit (TRU) identified CVE-2026-64600, a race condition in the Linux kernel’s XFS filesystem copy-on-write path. An attacker with an ordinary local account can exploit this race condition to overwrite protected files on disk and gain host root privileges on affected systems, including deployments running SELinux in Enforcing mode. This discovery emerged from a structured research initiative between Qualys and Anthropic, where we integrated Claude Mythos Preview into our manual audit workflow to accelerate our research while maintaining strict human oversight. Using this vulnerability, a process running as an ordinary, unprivileged user can trigger the flaw and gain the ability to overwrite any readable file on an XFS volume at the block layer. This primitive converts directly into host root privileges. Exploitation is highly reliable and leaves no kernel log output. The vulnerability affects any Linux distribution that ships an XFS root filesystem with reflink enabled. This includes default installations of major enterprise platforms such as RHEL, Oracle Linux, Amazon Linux, and Fedora. This vulnerability has been present since kernel version 4.11 (circa 2017) and, based on analysis with Qualys CyberSecurity Asset Management, potentially impacts over 16.4 million systems worldwide, requiring immediate attention due to its high exploitability and lack of kernel logging. Immediate kernel patching is recommended to neutralize this vulnerability. Exploitation succeeds consistently under standard hardening settings, and the on-disk modification survives a system reboot. Vendor-fixed kernels are now available and being backported to enterprise distributions. Organizations should prioritize patching exposed and multi-tenant systems and ensure a reboot to verify the update. As of now, there are no reliable or practical mitigations or temporary configuration changes available. We rate this as an emergency priority because exploitation could begin from ordinary local privileges. The vulnerability is present in standard enterprise kernel builds, and a successful exploitation provides host root. The exploitation works under common kernel hardening settings, and fixed kernels are available. RefluXFS is less about what AI can do than how it’s used responsibly. Capable models have been broadly available for some time; direction, not capability, was the constraint. The lesson isn’t that AI can be aimed at software to produce exploits; it’s that AI, paired with expert judgment, helps defenders find and close serious flaws before they’re abused. Discovery process and research methodology For this research, we tasked Claude Mythos Preview with hunting for a Dirty COW–style race condition in the Linux kernel, iteratively refining our prompts to narrow its focus toward race conditions in the core memory-management and filesystem directories. After several iterations, the model identified a race condition in the XFS filesystem and generated a functional proof-of-concept local privilege escalation. Our security researchers then took over: we reviewed the model’s reasoning, reproduced the exploit, and independently verified every technical claim before coordinating disclosure with upstream maintainers. The model also produced an initial draft of the advisory, which our team validated and corrected against our own testing. This human-validated, AI-accelerated approach let us surface a complex kernel race condition while holding to the strict accuracy and responsible-disclosure standards expected; every finding here cleared the same evidence bar we apply to any Qualys security advisory. Find out more about Qualys’ participation in Anthropic’s Project Glasswing. Read More Understanding the Potential Impact of the RefluXFS Vulnerability An unprivileged local user can overwrite the on-disk contents of any readable file on a reflink-enabled XFS volume. Our proof-of-concept reliably gains host root privileges by surgically modifying /etc/passwd or SUID-root binaries. Changes persist across reboots, leave no kernel log output, and bypass standard file metadata checks. While CVE-2026-64600 itself is strictly local, successful exploitation on a compromised host could enable attackers to establish persistence, manipulate credentials, or facilitate lateral movement within a network. Watch a RefluXFS Proof-of-concept Demonstration The following proof-of-concept shown in the video below shows the RefluXFS vulnerability on a default RHEL 10.2 deployment. Starting as an unprivileged local user with no administrative rights, the exploit triggers the race condition to silently overwrite a protected system file at the block layer. Within seconds, the root account’s password protection is stripped, granting immediate, passwordless root access. The modification persists across reboots and leaves no kernel log artifacts. RefluXFS PoC execution on RHEL 10.2. Unprivileged user escalates to root by exploiting the XFS reflink race condition. Affected Systems & Prerequisites Vulnerability Scope & Impact: The RefluXFS vulnerability affects systems meeting all three of the following criteria: Kernel Version: Running Linux kernel v4.11 or later (2017) without the specific security patch. Filesystem Configuration: Utilizing an XFS filesystem with reflink=1 in its superblock. File Structure: The filesystem must contain both a high-value target (a root-owned configuration file or SUID-root binary) and a directory writable by an unprivileged local user. Affected Distributions: This vulnerability has been present in every mainline and stable kernel since 2017. It requires no special capabilities or non-default configurations. The distributions listed below are those confirmed to be affected; this is not an exhaustive list, and other distributions, particularly those derived from RHEL, are likely vulnerable as well: RHEL 8, 9, and 10 CentOS Stream 8, 9, and 10 Oracle Linux 8, 9, and 10 Rocky and AlmaLinux 8, 9, 10 CloudLinux 8, 9, and 10 Amazon Linux 2023 and Amazon Linux 2 AMIs from December 2022 onward Fedora Server 31+ Debian, Ubuntu, and SUSE do not use XFS by default, but become exposed if an administrator manually selects XFS during installation, and reflink=1. For those running affected distributions, we recommend that you apply the latest security updates via your distribution’s advisory and perform a system reboot. How does RefluXFS work? RefluXFS is a race condition in the Linux kernel’s XFS filesystem copy-on-write (CoW) path. It allows an unprivileged local user to overwrite the on-disk contents of any readable file on a reflink-enabled XFS volume. The vulnerability triggers when two concurrent `O_DIRECT` writes target the same reflinked file. XFS uses CoW to handle writes to shared blocks: it allocates a new private block, remaps the file, and decrements the original block’s reference count. To avoid deadlocks, the kernel drops its inode lock while waiting for transaction log space. During this window, a second writer can complete its own CoW cycle, remapping the file to a new block and dropping the original block’s reference count to one. When the first writer re-acquires the lock, it re-checks the reference count using a stale physical block address captured before the lock was dropped. Seeing a count of one, it incorrectly assumes the block is private and proceeds to write directly to the original file’s physical block. Because `O_DIRECT` bypasses kernel page cache and lacks revalidation, the write persists to disk, overwriting th

Indicators of Compromise

• cve — CVE-2026-64600

Entities