"Immediate kernel patching is recommended to neutralize this vulnerability." That is how Saeed Abbasi, head of Qualys' Threat Research Unit, summarized the urgency around CVE-2026-64600 — a nine-year-old race condition in the Linux kernel's XFS filesystem that, when exploitable, allows a local attacker to overwrite protected files and gain root privileges.
RefluXFS and CVE-2026-64600: what was found and when
Qualys TRU has named the bug RefluXFS. The vulnerability exists in XFS when reflink is enabled and affects Linux kernels version 4.11 and later. Qualys reports the bug was introduced by commit 3c68d44a2b49 in February 2017 and has been present in every mainline and stable kernel since. The kernel patch that fixes the issue was merged on July 16 as commit 2f4acd0, and vendor-fixed kernels are now available and are being backported to enterprise distributions.
How the exploit works: reflink cloning, O_DIRECT races, and a lock-drop
Qualys describes a concise attack pattern. An attacker reflink-clones a target file — examples provided include /etc/passwd or a SUID-root binary such as /usr/bin/su — into a scratch file they own, then launches concurrent O_DIRECT writes against that scratch file. A race in the kernel's copy-on-write allocation path creates a lock-drop window; one of those concurrent writes can land on the physical block still backing the original file rather than the attacker's file.
Because the modification is made directly on disk, it persists across a reboot and produces no kernel log output. The change does not alter the original file's inode, so a modified SUID-root binary retains its SUID bit and remains setuid on execution, enabling privilege escalation to root.
Conditions required and affected distributions
RefluXFS is not universally applicable — exploitation requires several conditions to be true on a system:
- The filesystem must be XFS with reflink enabled (Qualys notes reflink is a default configuration on major enterprise Linux distributions).
- The system must be running Linux kernel v4.11 or later.
- There must be a directory writable by an unprivileged local user.
- There must be a high-value target on disk, such as a root-owned configuration file or a SUID-root binary.
Qualys lists the impacted distributions explicitly: Red Hat Enterprise Linux (RHEL), Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux and CloudLinux. Using its Cybersecurity Asset Management software, Qualys estimates the flaw potentially affects more than 16.4 million systems.
Why standard hardening and containment do not block RefluXFS
Qualys warns that common kernel- and environment-level hardening mechanisms do not prevent this attack because RefluXFS operates at the filesystem allocation layer, below where those defenses apply. The firm specifically states that Security-Enhanced Linux (SELinux), kernel lockdown, container isolation mechanisms, and memory-protection features such as KASLR, SMEP and SMAP fail to stop exploitation. Qualys also reports exploitation is "highly reliable," leaves no kernel log output, and on-disk modifications survive reboot — facts that increase the severity and stealthiness of successful attacks.
Research origin, remediation status, and operational guidance
Qualys says the discovery came from a research initiative between Qualys and Anthropic. The team integrated the AI model Claude Mythos Preview into manual audit workflows, tasked it with hunting for a race condition similar to the "Dirty COW" class, and reports the model identified the XFS flaw and generated a functional proof-of-concept. Qualys researchers then reviewed the model's output, reproduced the exploit, and independently verified the technical claims before coordinating disclosure with kernel maintainers.
According to Saeed Abbasi, "Immediate kernel patching is recommended to neutralize this vulnerability. Exploitation succeeds consistently under standard hardening settings, and the on-disk modification survives a system reboot." Qualys adds that vendor-fixed kernels are available and are being backported; organizations should prioritize patching exposed and multi-tenant systems and ensure a reboot to verify the update. The firm also states that "as of now, there are no reliable or practical mitigations or temporary configuration changes available."
What this means for technologists, security teams, and enterprise leaders
- Technologists and security teams: prioritize deploying the patched kernel builds and schedule reboots to ensure the on-disk fix is applied; do not rely on SELinux, kernel lockdown, container isolation, or memory protections as a stopgap.
- Enterprise and procurement leaders: track vendor backports for the listed distributions (RHEL, Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux, CloudLinux) and accelerate rollouts for multi-tenant and high-value systems.
- Operations and incident response teams: treat unexplained SUID changes or unauthorized alterations to root-owned files as high priority, but note that Qualys reports the exploit leaves no kernel log output and that changes persist across reboots, complicating detection based on kernel logging alone.
RefluXFS joins a string of Linux privilege-escalation disclosures this year — Qualys lists CIFSwitch, PinTheft, Copy Fail, Dirty Frag, Fragnesia, Pack2TheRoot, and DirtyDecrypt/DirtyCBC — underscoring that immediate patching and operational verification are the practical steps available now. Vendor-fixed kernels are in circulation; the practical question for organizations is how quickly they can validate and reboot the systems that meet the exploit's prerequisites.
Original source: BleepingComputer — New RefluXFS Linux flaw lets attackers gain root privileges
