THREATNOIR
Subscribe
Back to advisories

New RefluXFS Linux flaw lets attackers gain root privileges

A nine-year-old race condition in the Linux XFS filesystem (CVE-2026-64600) allows local attackers to overwrite protected files and escalate to root. Systems running kernel v4.11+ with XFS and reflink enabled are vulnerable. The exploit leaves no kernel logs and persists across reboots, making detection difficult.

CRITICALAdvisoryJul 25, 2026
Action required
Identify all Linux systems with XFS filesystem and reflink enabled. Prioritize patching kernel to latest version. Monitor for suspicious file modifications in /etc, /root, and other protected directories on affected systems.
Affected products
Linux kernelClaude Mythos PreviewQualys
CVE IDs
CVE-2026-64600
Linked articles
Source links